Add sandbox package for isolated Linux containers via Proxmox LXC

Provides a complete lifecycle manager for ephemeral sandbox environments:
- ProxmoxClient: thin REST wrapper for container CRUD, IP discovery, internet toggle
- SSHExecutor: persistent SSH/SFTP for command execution and file transfer
- Manager/Sandbox: high-level orchestrator tying Proxmox + SSH together
- 22 unit tests with mock Proxmox HTTP server
- Proxmox setup & hardening guide (docs/sandbox-setup.md)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

v2/CLAUDE.md

@@ -18,6 +18,7 @@
 - `provider/` — Provider interface that backends implement
 - `openai/`, `anthropic/`, `google/` — Provider implementations
 - `tools/` — Ready-to-use sample tools (WebSearch, Browser, Exec, ReadFile, WriteFile, HTTP)
+- `sandbox/` — Isolated Linux container environments via Proxmox LXC + SSH
 - `internal/schema/` — JSON Schema generation from Go structs
 - `internal/imageutil/` — Image compression utilities