#700 SEC-04: exec() used for dynamic code with bypass paths

Location: python_task.py:266, code_loader.py:668, app_runner.py:125. Issue: System uses exec() for user code. Sandbox mode can be disabled via config. dev_mount_path allows host filesystem access. Exempt tenants bypass sandbox. Fix: Remove unsandboxed fallback in production, enforce sandbox at app level.