feat: reachability and consumer profiles (SAND-WP-0011)

Add reachability enrichment (tunnel metadata, ops-bridge pointer),
secret_refs boundary resolution, profile.agent-dev and profile.build,
CLI reachability show, API endpoint, consumer smoke scripts, and tests.

tests/test_consumer_profiles.py

@@ -0,0 +1,20 @@
+"""Consumer profile loader smoke tests."""
+
+from sandboxer.profiles.loader import load_profile
+
+
+def test_profile_agent_dev_loads() -> None:
+    profile = load_profile("profile.agent-dev")
+    assert profile.id == "profile.agent-dev"
+    assert profile.extension == "ext.compose-ssh"
+    assert profile.scope_default == "agent"
+    assert profile.route is not None
+    assert profile.ttl.default == "8h"
+
+
+def test_profile_build_loads() -> None:
+    profile = load_profile("profile.build")
+    assert profile.id == "profile.build"
+    assert profile.extension == "ext.vm-packer"
+    assert "build-registry-token" in profile.setup.secret_refs
+    assert profile.reachability.tunnel == "ops-bridge"