fix(sandbox): route console logs to stderr

[johntmyers]

Summary

Route openshell-sandbox console shorthand logging to stderr so payload-producing commands keep stdout clean.

Related Issue

Closes #902

Changes

• switched both console shorthand tracing sinks in openshell-sandbox from stdout to stderr
• updated the /var/log fallback warning to describe stderr-only console logging
• added a regression test covering startup logs on stderr with clean stdout
• updated the sandbox custom-container architecture note to match the new behavior

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Notes:

• Ran RUSTC_WRAPPER= cargo test -p openshell-sandbox --test stdout_logging successfully.
• Ran mise run pre-commit, but the workspace test:rust task fails in this environment because openshell-prover cannot link z3 (ld: library 'z3' not found).

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.