Workflows declare their sandbox: Sandbox(setup=...), ensured at install, leased by hash

[czpython]

ENG-882 — the druks half of the sandbox-needs design.

A workflow ships the tools its agents need as a plain shell file:

class BuildSite(Workflow):
    sandbox = Sandbox(setup="site_builder/sandbox.sh")

• Sandbox joins the author surface in druks.workflows. The declaration holds the path; resolution reads raw bytes from the app package's templates/ at use time, like agent prompts. Identity is the content hash of (base, script bytes). Apps never name images.
• Druks collects declared sandboxes from installed workflows and asks drukbox to build a template for each — at boot, at app settings save, and at druks doctor. The request is async (202); druks never builds on a lease miss.
• Both lease paths (warm run host and per-call ephemeral) resolve the declaration to its template and fork from it. A run whose template is still building waits with a visible "Building sandbox…" phase.
• druks doctor reports each declared sandbox: available, building (pending), missing, or failed.
• An operator MAY pin a declared sandbox's hash to a provider artifact via [sandbox.pins] in druks.toml. No pin is ever required.

Activates when drukbox ENG-877/ENG-879 and their drukbox-python-sdk mirror land; until then the new client calls (create_template, list_templates, create_host(template=...)) are exercised only by tests, and ordinary leases are unchanged on the current SDK.