feat: reachability and consumer profiles (SAND-WP-0011)

Add reachability enrichment (tunnel metadata, ops-bridge pointer),
secret_refs boundary resolution, profile.agent-dev and profile.build,
CLI reachability show, API endpoint, consumer smoke scripts, and tests.

src/sandboxer/models.py

@@ -153,6 +153,9 @@ class Reachability(BaseModel):
     compose_project: str | None = None
     host: str | None = None
     endpoint: str | None = None
+    tunnel: str | None = None
+    tunnel_via: str | None = None
+    identity: str | None = None
 
 
 class SandboxStatus(BaseModel):