Isolate /dev/shm per sandbox to prevent cross-execution data leakage

Co-Authored-By: Claude <noreply@anthropic.com>

Author: koki-develop

api/src/job.js

@@ -163,6 +163,7 @@ class Job {
                 `PISTON_LANGUAGE=${this.runtime.language}`,
                 `--dir=${this.runtime.pkgdir}`,
                 `--dir=/etc:noexec`,
+                `--dir=/dev/shm:tmp`,
                 `--processes=${this.runtime.max_process_count}`,
                 `--open-files=${this.runtime.max_open_files}`,
                 `--fsize=${Math.floor(this.runtime.max_file_size / 1000)}`,