Fix: AST-based sandbox validation (#62) and Windows test compatibility

[Gaurav06Poddar]

Summary

This PR addresses two key issues in the repository:

1. Sandbox Security Vulnerability (regex sandbox bypass via dynamic import / getattr #62): Replaces basic string/regex validation of LLM-generated kernels with a strict Abstract Syntax Tree (ast.NodeVisitor) parser to catch dynamic code execution and import evasions.
2. Windows Test Suite Compatibility: Resolves PermissionError: [WinError 32] in tests/test_config_injectable.py caused by file locking on Windows when deleting open temporary files.

---

Changes Made

• triton_kernel_agent/worker_util.py: Added validate_kernel_ast() to inspect AST nodes and block dynamic execution constructs (eval, exec, __import__, getattr, __builtins__, importlib, etc.).
• triton_kernel_agent/worker.py: Integrated validate_kernel_ast() directly into _validate_kernel_candidate() prior to worker test execution.
• tests/test_ast_validator.py: Added a comprehensive test suite covering safe code, complex Triton kernels, dynamic import evasions, string-constructed calls, and invalid syntax edge cases.
• tests/test_config_injectable.py: Explicitly called .close() on temporary file handles before entering the try/finally block to release file locks on Windows environments.

---

Test Plan

• Ran full unit test suite locally on Windows (pytest tests/ -v).
• Confirmed all 64 unit tests pass cleanly without regressions.

[meta-cla]

Hi @Gaurav06Poddar!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

[meta-cla]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!