#944 Rewrite golden demos and host-dependent templates for the sandboxed shell

EARS: Every template in api/dsl_templates and every golden demo shall run with tools.shell.run sandboxed (network none, no host paths), passing state between tasks via workflow variables/artifacts, never via host files. Broken by #915: golden_deterministic_v2, golden_disaster_recovery, golden_ultimate_correctness, use_cases/eod_banking_etl (sandbox=False + /data/demo shared state); git_repo_workflow; kafka_pipeline_workflow; long_running_python_http_server + verified/http_server_long_running; verified/bug_report_workflow (jq/issuedb-cli); tests curl_ifconfig_workflow, docker_log_test. Lead recommendation: rewrite, do not allowlist a root tenant next to docker.sock. Memory 'demo_workflows' (golden standard) applies: re-verify each after rewrite.