Promote Docker Sandboxes host-trust fixes to main

[joecklau]

Summary

• promote the Docker Sandboxes empty policy-attribution compatibility fix from develop
• promote steady-state host-trust reconciliation that remains valid while a runner job is active
• preserve fail-closed relay verification, durable quarantine, and exact idle retirement behavior

Verification

• focused pool tests, including race tests
• full internal/pool normal and race test suites
• Docker Sandboxes host-trust and relay normal and race tests
• go vet for affected packages
• repository-wide go test ./... passes except for three pre-existing Windows/WSL SSH-agent-forwarding diagnostic subcases
• independent review of the implemented fix found no actionable issues