[Jaana Dogan (rakyll)]

This removes a set of features that widened what ate-env-api and the guest can be made to do, without review in proportion to that reach.

Removed:

• Runtime layers and sidecars: ate-env manifest template --layer, --sidecar and --sidecar-readyz, and the guest's -sidecar and -sidecar-readyz support (cmd/ate-env-guest/sidecar.go). /readyz answers once the guest is listening.
• Port proxy (internal/portproxy) and its ate-env-api flags --atenet-connect, --port-proxy-trusted-origins and --port-proxy-response-header-timeout, plus the CONNECT support in the fake router.
• On-demand rootfs images: CreateEnvironmentRequest.rootfs_image, the server-side derivation of <base>-<digest> ActorTemplates, ate-env create --rootfs-image, and rootfs_image= in the Python client. ate-env manifest template --rootfs-image stays: operators can still register image templates themselves.
• The NeMo Gym integration (integrations/nemo-gym), which depended on the port proxy and on runtime layers.
• SWE-bench benchmarking (cmd/benchmarking, internal/benchmarking, benchmarking/), which depended on on-demand rootfs images.
• Docs for all of the above: docs/rootfs-images, examples/runtime-layers, and the related README sections.

Security:

• The port proxy forwarded HTTP from anyone who could reach ate-env-api's listener to any TCP port of any actor the Substrate router serves, in any atespace, including actors ate-env did not create. It authenticated no caller. Its own documentation listed DNS rebinding against the listener (and the MCP endpoint) as not yet blocked. In effect, the network boundary of the API service became the only access control for every port of every actor in the cluster.
• On-demand rootfs images let any caller of CreateEnvironment make ate-env-api create ActorTemplates that run an image of the caller's choosing under the operator's base template settings: snapshot bucket, sandbox config and resources. ate-env-api's identity needed template-creation rights for this, and the derived templates were never garbage-collected, so callers could grow them without bound.
• Sidecars let a template make the guest, PID 1 in every actor, start and restart arbitrary binaries next to it. This added a second data-plane process per actor with no isolation or resource limits of its own, which the port proxy then exposed.

Process suggestions:

Changes of this size to a project like this, which adds new network surface, new privileges for the API service, new wire-protocol fields, and new integrations, need substantial design discussion and security review before they are merged. They should not land incrementally through feature PRs. Any of these capabilities can come back through a design proposal with a threat model and explicit sign-off.

There may be more changes to clean up and should be followed up.

Most of the changes removed by this PR belong to an examples corpus. We cannot take a dependency to a large surface of third party integrations and have to patch this repo for security vulnerabilities, etc.