__import__ available in policy-as-code sandbox builtins

[vnykmshr]

The safe_globals builtins dict in simulation.py includes __import__, making it accessible to exec'd code via __builtins__['__import__']. The AST validator blocks direct __import__() calls but not subscript access.