Cyber-Zero: Training Cybersecurity Agents without Runtime