Add local reachability descriptor for same-host extensions (SAND-WP-0013-T04)

Reachability gains pid/workspace_dir, populated by enrich_reachability
whenever a backend's wait_ready() returns a pid: endpoint (currently
just ext.bwrap). build_reachability_report() now also returns a
local_exec_hint (nsenter into the pid's namespaces) alongside the
existing ssh_one_liner, so glas-harness can branch on which is
populated instead of assuming every sandbox is SSH-reachable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/sandboxer/models.py

@@ -156,6 +156,11 @@ class Reachability(BaseModel):
     tunnel: str | None = None
     tunnel_via: str | None = None
     identity: str | None = None
+    # Local (no-SSH-hop) descriptor — populated for same-host extensions
+    # like ext.bwrap. A consumer execs into the sandbox directly
+    # (e.g. `nsenter --target <pid> ...`) rather than over SSH.
+    pid: str | None = None
+    workspace_dir: str | None = None
 
 
 class SandboxStatus(BaseModel):