fix(security): 0.40.3 deferred hardening - out-of-process code, SSRF pinning, MCP scoping

[gizmax]

Follow-up to #273 (0.40.2, merged). Finishes the three harder deferred audit items. Rebased onto main after #273 merged (supersedes the auto-closed #274).

What's in this PR

• Code steps run out-of-process by default (CODE_STEPS_OUT_OF_PROCESS, default true): a separate Python subprocess with a secret-free env and POSIX CPU/address-space limits, really killed on timeout. Same AST validator, blocklist, and secret-free helpers re-run in the child. Parent validates before spawning; infra failures fall back to in-process.
• HTTP-step SSRF IP-pinning: custom httpx.AsyncHTTPTransport dials the pre-validated IP while preserving Host + TLS SNI, closing the DNS-rebind TOCTOU. Mocked/non-resolvable hosts unaffected.
• Memory MCP per-tenant scope: MEMORY_MCP_SCOPE_PREFIX enforced on add/search/list_memories/forget; forget requires + validates the owning user_id.

CI / testing

• Tests run in-process in the suite via conftest (env + fixture) so the ~17k-test suite stays fast; the out-of-process path is covered by test_code_subprocess_runner.py.
• pr-tests.yml Python job timeout-minutes 15 -> 20 (the suite legitimately runs ~13.5 min plus setup; the old gate cancelled a passing run at the 15 min mark).
• Reviewed line-by-line by the lead + independently re-run: deferred modules 325 passed, code-step regression 456 passed, full CI green (17003 passed).

Residual notes (reviewed, acceptable)

• Out-of-process adds ~170ms per code step; toggle CODE_STEPS_OUT_OF_PROCESS=false for loop-heavy workloads.
• Memory forget validates the supplied user_id is in-prefix but cannot cross-check the memory_id owner (mem0 has no owner-by-id lookup); safe for per-tenant deployments.