fix(sandbox): let go install cached toolchains without a download

[mike-diff]

Problem

When a repository's go.mod asks for a newer Go than the installed one, go downloads that toolchain. proxy.golang.org redirects toolchain downloads to storage.googleapis.com, which the sandbox proxy does not allow, so the checks fail. This parked shift #81 ("checks failed twice": go: download go1.24.0 ... storage.googleapis.com).

Allowing storage.googleapis.com would open a general upload host, so this fix does not.

Change

• The sandbox reads the person's cached Go toolchains (<GOMODCACHE>/cache/download/golang.org/toolchain) read-only. Only that directory is exposed; other cached modules stay hidden.
• GOPROXY in the sandbox is file://<download cache>,https://proxy.golang.org,direct, so go installs a cached toolchain from the local file proxy. Go still verifies it against the checksum database. A toolchain that is not cached falls through to proxy.golang.org as before.
• GOPROXY is now always set by the sandbox, so env: cannot override it.

Verification

• shift's full checks command (build, vet, gofmt, go test) passes through the sandbox on the host where it failed, including the switch to Go 1.24.
• New test: the cached toolchains are readable through the file proxy, and another cached module is not. It fails when the bind is removed, when GOPROXY is not set, and when the whole module cache is exposed instead of the toolchains.
• vet, gofmt and staticcheck clean on Linux and macOS; full suite passes.