feat: add security_opt support for execution client containers (#9)

* feat: add security_opt support for execution client containers

Add a `security_opt` field to the scenario config that gets passed
to Docker's `containers.run()`. This allows setting Docker security
options like `seccomp=unconfined` which is needed for profiling tools
(e.g., perf/perfcollect) to call `perf_event_open` inside containers.

Example usage in scenario config:
```yaml
security_opt:
  - seccomp=unconfined
```

* feat: add 30s grace period before stopping execution client

* fix: remove redundant inline import - time already imported at top

* fix: increase stop timeout to 60s instead of pre-stop sleep

WritePGOData only flushes on process exit (SIGTERM handler), not while
idle. The 30s sleep before stop was pointless - Nethermind just sits
waiting for blocks. Instead increase Docker's SIGTERM-to-SIGKILL
timeout from 10s to 60s so the shutdown handler has time to flush.

* fix: rename security_opt to execution_client_security_opt for consistency

* fix: increase stop timeout to 120s for RocksDB flush + PGO data write

---------

Co-authored-by: Carlos Bermudez Porto <cbermudez.dev@gmail.com>

Author: benaadams

src/expb/configs/scenarios.py

@@ -161,6 +161,10 @@ class Scenario(BaseModel):
         description="Extra commands to run in the execution client docker container during the test execution.",
         default=[],
     )
+    security_opt: list[str] = Field(
+        description="Docker security options for the execution client container (e.g., seccomp=unconfined).",
+        default=[],
+    )
 
     @field_validator("client", mode="before")
     @classmethod

src/expb/payloads/executor/executor.py

@@ -426,6 +426,8 @@ def start_execution_client(
             run_kwargs["cpuset_cpus"] = self.config.resources.cpuset
         if self.config.resources and self.config.resources.mem_swappiness is not None:
             run_kwargs["mem_swappiness"] = self.config.resources.mem_swappiness
+        if self.config.execution_client_security_opt:
+            run_kwargs["security_opt"] = self.config.execution_client_security_opt
         container = self.config.docker_client.containers.run(**run_kwargs)
         return container
 
@@ -1029,9 +1031,10 @@ def cleanup_scenario(
             )
             execution_client_container.reload()
             execution_client_volumes = execution_client_container.attrs["Mounts"]
-            execution_client_container.stop(
-                timeout=60 if self._dottrace_active else 5
-            )
+            # Give execution client 120s after SIGTERM to flush data (e.g. PGO
+            # profiles via WritePGOData, RocksDB flush, and dotTrace snapshot
+            # writes) before Docker sends SIGKILL (default 10s)
+            execution_client_container.stop(timeout=120)
             logs_file = (
                 self.config.outputs_dir
                 / f"{self.config.get_execution_client_name()}.log"

src/expb/payloads/executor/executor_config.py

@@ -67,6 +67,7 @@ def __init__(
             scenario.extra_volumes
         )
         self.execution_client_extra_commands = scenario.extra_commands
+        self.execution_client_security_opt = scenario.security_opt
 
         # Executor Additional Tooling config
         ## Docker client