fix: improve executor portability and configuration defaults

[matthewpeterkort]

Summary

• restore writable /tmp in the default read-only Docker container with an executor-local tmpfs
• suppress that tmpfs when a TES task explicitly mounts /tmp or an ancestor
• update host resource detection to gopsutil/v4 and detect CPU, memory, and disk independently
• correct RPC credential nesting in the configuration docs and examples, with parsing regression coverage

Adam Novak's three-line documentation change from #1447 is preserved as its own authored commit. That PR remains open for the contributor/maintainer to close separately.

Verification

• go test ./... -count=1 (413 tests across 83 packages)
• Apple Silicon host resource probe through the scheduler suite
• Docker smoke test: read-only root with writable /tmp tmpfs
• template tests for implicit tmpfs and explicit /tmp volume suppression

Refs #1446
Refs #1448
Refs #1449

[matthewpeterkort]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: f8ccee4a2f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Gen3 Integration Tests

filepath	passed	skipped	SUBTOTAL
tests/test_gen3_workflow.py	29	2	31
TOTAL	29	2	31

[matthewpeterkort]

@adamnovak this PR should address your current issues.