fix(v1): allow concurrent borrowed runtime environments

[parkerpettit]

Summary

• give each unrestricted borrowed rollout an environment-scoped runtime view
• keep restricted runtimes serialized because their network policy changes box-global state
• preserve owner lifecycle checks against the physical runtime
• add regression coverage for concurrent environment isolation and restricted serialization

Why

The Harbor runtime environment change serialized every borrowed rollout through one lock. That prevents two agents from running concurrently in the same box, even when the runtime has no mutable network policy.

Runtime.with_env() keeps the physical sandbox handles shared while each rollout gets its own process environment.

Tests

• uv run --project third_party/verifiers pytest third_party/verifiers/tests/v1/test_borrowed_runtime_env.py -q
• uv run --project third_party/verifiers ruff check third_party/verifiers/verifiers/v1/rollout.py third_party/verifiers/verifiers/v1/runtimes/base.py third_party/verifiers/tests/v1/test_borrowed_runtime_env.py
• uv run --project third_party/verifiers ruff format --check third_party/verifiers/verifiers/v1/rollout.py third_party/verifiers/verifiers/v1/runtimes/base.py third_party/verifiers/tests/v1/test_borrowed_runtime_env.py

Note

Fix Rollout.open to allow concurrent borrowed runtime environments

• Adds Runtime.with_env in base.py to create a shallow-copied runtime view with an isolated env while sharing the underlying sandbox
• Rollout.open now stores the original borrowed runtime in _borrowed_runtime; unrestricted borrowers call with_env per rollout instead of taking the borrow lock, so concurrent rollouts get independent envs
• Network-restricted borrowers (e.g. Docker with empty allow-list) still acquire borrow_lock and swap runtime.env serially, preserving the owner's env across teardown
• Rollout.fail checks _borrowed_runtime.stopped to correctly detect teardown of the originally borrowed runtime even when self.runtime has been replaced by a view
• Behavioral Change: unrestricted borrowed runtimes no longer acquire borrow_lock in Rollout.open; concurrent rollouts now run in parallel where they were previously serialized

^{Macroscope summarized f6e3322.}