feat: reachability and consumer profiles (SAND-WP-0011)

Add reachability enrichment (tunnel metadata, ops-bridge pointer),
secret_refs boundary resolution, profile.agent-dev and profile.build,
CLI reachability show, API endpoint, consumer smoke scripts, and tests.

src/sandboxer/api/app.py

@@ -34,6 +34,14 @@ def get_sandbox(sandbox_id: str) -> SandboxStatus:
     return status
 
 
+@app.get("/v1/sandboxes/{sandbox_id}/reachability")
+def get_sandbox_reachability(sandbox_id: str) -> dict:
+    try:
+        return _manager.reachability_report(sandbox_id)
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail=str(exc)) from exc
+
+
 @app.get("/v1/sandboxes", response_model=list[SandboxStatus])
 def list_sandboxes() -> list[SandboxStatus]:
     return _manager.list()