__import__ available in policy-as-code sandbox builtins

The `safe_globals` builtins dict in `simulation.py` includes `__import__`, making it accessible to exec'd code via `__builtins__['__import__']`. The AST validator blocks direct `__import__()` calls but not subscript access.