Soft-Machine-io security

• CVE-2026-55176 Critical 9.0 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token 0.3%
• CVE-2026-46711 High 8.3 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network 0.3%