feat: add sandbox endpoint auth headers

[ninan-nn]

Summary

• add per-sandbox egress auth header generation and propagation through lifecycle endpoint responses
• wire Docker and Kubernetes runtimes to persist the auth token in runtime metadata, inject it into the egress sidecar, and merge it with existing endpoint headers
• update SDK layers to consume endpoint headers for execd/egress access, including server-proxy flows
• fix Docker server-proxy endpoint resolution for bridge sandboxes with egress sidecar by falling back to host-mapped endpoint resolution when internal IP resolution is not applicable
• add unit and multi-language e2e coverage for direct and server-proxy egress access

Testing

• Not run (please update if local/CI verification has already been done)
• Unit tests added/updated in this PR
• Integration tests
• e2e / manual verification coverage added/updated in this PR

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d47025464

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Pangjiping]

LGTM

[hittyt]

LGTM