Imaging evaluation

Container references are visible only to the submitting team and operators.

Exit status, precise runtime and output fingerprints are restricted to operators.

No network · read-only input and root filesystem · all Linux capabilities dropped · only submission.zip and this audit record retained.