chore(cloud-agent-next): add DIND small sandbox

[kilo-code-bot]

Summary

• Add a Docker-in-Docker Cloudflare Sandbox image for SandboxSmall so it can run rootless Docker and eventually user devcontainers.
• Include the existing cloud-agent wrapper build, @devcontainers/cli, GitHub/GitLab CLIs, and a /opt/kilo-agent Kilo binary bundle for inner containers.
• Point SandboxSmall at the DIND image in production and dev Wrangler container config.

Verification

• No manual runtime verification; this sandbox does not have Docker available, so the image needs local Docker/Cloudflare testing.

Visual Changes

N/A

Reviewer Notes

• Draft PR for local continuation/testing.
• Pushed with --no-verify at user request after pre-push hooks timed out in this sandbox.
• Focus review on the DIND Dockerfile package choices and whether SandboxSmall should use this image in both prod and dev config.