fix(sandbox): bake project source synchronizer

[iamjr15]

Why

Production cold-cache recovery exposed that the source-mirror implementation was transported as one inline Python command argument. The sandbox runtime correctly rejects arguments above 8 KiB, so preview preparation failed before dependency restoration could run.

What changed

• move the project source synchronizer into the immutable sandbox image as a root-owned executable
• keep Worker-to-sandbox commands bounded to the helper path and validated runtime arguments
• retain the existing conflict-safe package transaction and continuous preview mirror semantics
• smoke-test the helper's executable bit and Python syntax during snapshot publication
• document the image/Worker ownership boundary

Architecture effects

This makes the immutable sandbox snapshot the source of truth for executable sandbox runtime code. Promotion therefore requires a new verified Daytona snapshot followed by the normal reviewed DAYTONA_SANDBOX_SNAPSHOT configuration change.

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• actionlint .github/workflows/build-snapshot.yml
• git diff --check
• local source-sync success and concurrent-write conflict checks
• generated preview command argument lengths: [2, 3, 1592] (all below the 8 KiB sandbox contract)

All repository gates ran with Node 24.18.0 and pnpm 11.15.0.