refactor(cli): split sandbox.ts into per-backend modules

[jdmanring]

Summary

Decomposes the monolithic sandbox.ts into per-backend modules:

• C-01: Split sandbox.ts into sandbox-seatbelt.ts, sandbox-docker.ts, sandbox-shared.ts, sandbox-path.ts, sandboxImageName.ts, sandboxMounts.ts

Files Changed

• packages/cli/src/utils/sandbox.ts (reduced to entry point)
• packages/cli/src/utils/sandbox-seatbelt.ts (new)
• packages/cli/src/utils/sandbox-docker.ts (new)
• packages/cli/src/utils/sandbox-shared.ts (new)
• packages/cli/src/utils/sandbox-path.ts (new)
• packages/cli/src/utils/sandboxImageName.ts (new)
• packages/cli/src/utils/sandboxMounts.ts (new)

Type of Change

• Refactor
• Bug fix
• New feature
• Breaking change

Rationale

Single Responsibility Principle: Seatbelt and Docker/Podman paths share almost no code but lived in the same file. Separation improves testability and maintainability.

Testing

• Unit tests pass
• Integration tests pass