chore(config): retire unread keys [sandbox] network, [sandbox] workspace_readonly, [complexity] top_k

Legacy inventory 2, item R3. The three keys loaded into ResolvedConfig and nothing read them: no
`.network`, `.workspace_readonly` or `.top_k` access exists in src outside config.py. The sandbox
runner always passes `--network none` and `--read-only` and rejects host networking by argv
inspection, so the two sandbox keys were knobs that turned nothing; no stage read top_k, and
`[complexity] max_hunter_hotspots` is the one complexity key the scan reads. They join RETIRED_KEYS
with the same 2026-10-02 mechanism as the other unread keys (RetiredConfigError naming the reason).
The fields and their loaders are removed; memory_mb, timeout_seconds, pids_limit (read by
regress/recipes.py and sandbox/runner.py) and max_hunter_hotspots stay. test_config.py covers the three
retirements and the override test now exercises max_hunter_hotspots. RELEASE_NOTES Unreleased carries
the line.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/config.py

@@ -24,6 +24,11 @@ _UNREAD_ON = "retired 2026-10-02 because nothing ever read it"
 _UNREAD_DYNAMIC = "no dynamic or deep tier exists; deep mode will define its own keys when it is built"
 _UNREAD_EVIDENCE = "evidence tiers come from the program model's ladder (model/ladder.py), not from configuration"
 _UNREAD_VARIANTS = "the structural variant search it configured was deleted with semantic/variants.py"
+_UNREAD_SANDBOX = (
+    "the sandbox always runs with `--network none` and a read-only workspace (sandbox/runner.py); that is an "
+    "invariant the runner enforces, not a knob"
+)
+_UNREAD_TOP_K = "no stage read it; `[complexity] max_hunter_hotspots` is the one complexity key the scan reads"
 _UNREAD_EMBEDDINGS = (
     "the json-local vector index it configured and `ousast index` were deleted; the decision engine embeds through "
     "`ousast learn memory embed --model` (learn/embeddings.py)"
@@ -42,6 +47,9 @@ RETIRED_KEYS: dict[tuple[str, str], str] = {
     ("variants", "max_mechanisms"): f"{_UNREAD_ON}: {_UNREAD_VARIANTS}",
     ("embeddings", "model"): f"{_UNREAD_ON}: {_UNREAD_EMBEDDINGS}",
     ("embeddings", "store"): f"{_UNREAD_ON}: {_UNREAD_EMBEDDINGS}",
+    ("sandbox", "network"): f"{_UNREAD_ON}: {_UNREAD_SANDBOX}",
+    ("sandbox", "workspace_readonly"): f"{_UNREAD_ON}: {_UNREAD_SANDBOX}",
+    ("complexity", "top_k"): f"{_UNREAD_ON}: {_UNREAD_TOP_K}",
 }
 RETIRED_SECTION = "harnessx"  # retired 2026-09-30: loads with one warning and is otherwise ignored (Req 3.3)
 RETIRED_SECTION_WARNING = (
@@ -100,8 +108,6 @@ class ModelConfig:
 
 @dataclass(frozen=True)
 class SandboxConfig:
-    network: bool = False
-    workspace_readonly: bool = True
     memory_mb: int = 2048
     timeout_seconds: int = 300
     pids_limit: int = 512
@@ -146,8 +152,7 @@ class FusionConfig:
 
 @dataclass(frozen=True)
 class ComplexityConfig:
-    # Stage-2 map size and hunter attention. Small defaults keep PR/nightly map work cheap.
-    top_k: int = 20
+    # Hunter attention. A small default keeps PR/nightly map work cheap.
     max_hunter_hotspots: int = 8
 
 
@@ -276,8 +281,6 @@ def _load_models(value: object) -> ModelConfig:
 def _load_sandbox(value: object) -> SandboxConfig:
     data = _section(value)
     return SandboxConfig(
-        network=bool(data.get("network", False)),
-        workspace_readonly=bool(data.get("workspace_readonly", True)),
         memory_mb=_int_value(data.get("memory_mb"), 2048),
         timeout_seconds=_int_value(data.get("timeout_seconds"), 300),
         pids_limit=_int_value(data.get("pids_limit"), 512),
@@ -337,7 +340,6 @@ def _load_fusion(value: object) -> FusionConfig:
 def _load_complexity(value: object) -> ComplexityConfig:
     data = _section(value)
     return ComplexityConfig(
-        top_k=_int_value(data.get("top_k"), 20),
         max_hunter_hotspots=_int_value(data.get("max_hunter_hotspots"), 8),
     )