feat: configurable pids_limit, blkio_weight, and device_read_bps

[thejoeejoee]

CPU and memory limits are already configurable per-workspace (cpu, memory), but other resource knobs are either hardcoded or missing entirely:

• pids_limit — hardcoded to 256 in the compose template (line 63). Some builds and test suites fork heavily and hit this limit.
• blkio_weight — not set. Agents doing heavy I/O (large builds, dependency installs) can saturate host disk bandwidth.
• device_read_bps / device_write_bps — not set. No per-workspace throttle on sequential I/O.

Proposal

Add optional workspace-level config fields with sensible defaults:

[defaults]
pids_limit = 256          # current implicit default, now explicit
blkio_weight = 500        # 100–1000, relative weight
# device_read_bps = ""    # e.g. "100m" (bytes/sec), unset = unlimited
# device_write_bps = ""   # e.g. "100m" (bytes/sec), unset = unlimited

[workspaces.heavy-build]
pids_limit = 1024
blkio_weight = 200
device_read_bps = "50m"
device_write_bps = "50m"

Data flow follows existing CPU/memory pattern:

1. Add fields to BaseConfig in config.go (with *int / *string pointers for optional)
2. Merge in workspace.Resolve() with intWithDefault() / stringWithDefault()
3. Pass through ComposeParams to the compose template
4. Add validation: pids_limit > 0, blkio_weight in [100, 1000], byte-rate format regex

Why

• Lets users tune process limits for build-heavy workspaces without a custom image
• Prevents a single workspace from monopolizing host I/O
• Completes the resource-limit story alongside existing cpu and memory