test(stack): add sandbox E2E tests for volumes, secrets, env_file, multi-network

Four new real-VM integration tests validating sandbox features:

- sandbox_bind_mount_and_named_volume: host file visible via VirtioFS bind mount,
  two services sharing a named volume can read each other's writes
- sandbox_secret_injection: file-based secrets available at /run/secrets/<name>
  inside sandbox containers
- sandbox_env_file_loading: env_file vars loaded into container env, inline
  environment takes precedence over env_file values
- sandbox_multi_network_isolation: services on frontend-only network cannot
  ping services on backend-only network; bridge service on both can reach both

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lightsofapollo