feat(runtime): add codex sandbox worker runtime

[GatewayJ]

Summary

• Add the codex_sandbox worker runtime, gateway entrypoint, sandbox image material, and embedded worker template.
• Wire Codex Sandbox through runtime selection, API/template parsing, Feishu credential injection, and model/profile recreation handling.
• Update the web create flow to expose Codex Sandbox choices and keep template-created agent names editable.

Validation

• git diff --check
• env GOCACHE=/tmp/gocache go test ./internal/agent ./internal/api ./internal/template
• env GOCACHE=/tmp/gocache go test ./internal/runtime/codexsandbox ./internal/app/runtimewiring ./cmd/csgclaw-codex-gateway
• pnpm exec vitest run tests/api/agents.test.ts
• pnpm exec vitest run tests/models/agents.test.ts
• pnpm exec vitest run tests/components/AgentProfileModal.test.tsx

Notes

• Codex Sandbox remains a worker-only sandbox runtime, separate from the host-local Codex runtime.
• The sandbox image tag is documented in the build docs and can be rebuilt from docker/codex-sandbox/Dockerfile.