Function select_backend 

pub fn select_backend(
    config: &ForgeConfig,
) -> ForgeResult<Box<dyn ExecutionBackend>>

Select the best available backend based on config.

Sealed mode enforcement:

• "host" explicit: rejected unless sealed_allow_host_backend = true.
• "container" explicit: never falls back to host; errors if container unavailable.
• "auto": tries container first; only falls back to host if not sealed or sealed_allow_host_backend = true.