Fix sandbox agent bundle imports before chat

[chubes4]

Summary

• Adds a generic agent_bundles sandbox contract for multiple Data Machine agent bundle specs, preserving source URL/path specs and inline bundle JSON through task input, recipe, CLI, and browser-session paths.
• Imports declared bundles through the canonical datamachine/import-agent ability before invoking agents/chat, with the legacy direct create_if_missing() row seed retained only as a no-bundle fallback.
• Fails sandbox invocation early when bundle imports fail and records bundle import diagnostics in sandbox/browser results.

Testing

• npm run build
• npm run task-input-contract-smoke
• npm run agent-sandbox-code-smoke
• npm run wordpress-recipe-builders-smoke
• php tests/smoke-wordpress-plugin.php

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (openai/gpt-5.5)
• Used for: Drafted and tested the sandbox agent bundle import contract and smoke coverage; Chris remains responsible for review and merge.