Harden benchmark worker and offline transform sandbox

[anupsv]

Summary

• keep hidden benchmark oracle tokens out of the runtime worker by switching benchmark decode to begin/step requests
• run correctness and timed benchmark in separate worker processes
• tighten runtime/offline sandboxes: no network, no child process execution, no worker writes, transform writes only to weights
• validate overlaid editable paths after copy and remove stale make-golden docs

Validation

• bash -n benchmark.sh .github/scripts/run-offline.sh .github/scripts/overlay-editable-paths.sh setup.sh
• swift test --filter BenchmarkScriptTests
• swift test --filter 'BenchmarkScriptTests|BenchmarkSupportTests|GoldenTests'
• CLANG_MODULE_CACHE_PATH=$PWD/.build/clang-module-cache swift build -c release

Note: a full local swift test still requires mlx.metallib for existing unguarded MLX runtime tests; the focused non-runtime hardening tests pass.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}