* docs: default agent validation to remote runners * docs: isolate untrusted validation networking * fix: harden untrusted Crabbox validation * docs: refresh generated docs map