Mount the sandbox scripts directory and fail loudly when sbx exec can't start a command

[mxriverlynn]

Problem

Running an eval from a repo other than skillwalker (for example han) failed on every test:

OCI runtime exec failed: executable file `/Users/.../skillwalker/build/sandbox-run.sh` not found: No such file or directory
[DONE] "Prompt: /architectural-analysis of go-project runner module"
  - Duration (ms): 0
  - Input Tokens:  0

There were two bugs:

1. The sandbox couldn't see skillwalker's scripts. sbx exec runs sandbox-run.sh and sandbox-extract.sh by their host path, but the sandbox only sees host paths under a mounted workspace. sandbox create mounted only --repo-root, which is the target repo. So this failed whenever the target repo wasn't the skillwalker repo.
2. The failure was reported as a pass. When sbx exec can't start the command, it prints OCI runtime exec failed and still exits 0. The test runner's exit-code check never fired, so the test showed [DONE] with zero tokens.

Changes

• createSandbox and updateSandbox take optional extraWorkspaces, mounted read-only after the repo root (sbx run ... claude <repoRoot> <dir>:ro). A workspace already inside the repo root is skipped.
• sandbox create and sandbox update pass the scripts directory: build/ for the compiled binary, packages/claude-integration/ from source. It's exported as sandboxScriptsDir from a new claude-integration/src/sandbox-scripts.ts, which run-claude.ts and extract-output-files.ts now also use.
• execInSandbox throws SandboxError when any stdout or stderr line starts with OCI runtime exec failed. The error includes a hint to run skillwalker sandbox update.
• cli/index.ts prints SandboxError as Error: <message> and exits 1, instead of printing a stack trace.
• Updated docs/sandbox-integration.md and docs/sandbox-integration-package.md.

After merging

Existing sandboxes still have the old single mount. Run skillwalker sandbox update from the target repo once to recreate the sandbox with both mounts.

Testing

• make test: all 1022 tests pass, including new tests for the mount args, skipping nested workspaces, and detecting the exec failure. Detection matches only at the start of a line, so Claude output that merely mentions the message doesn't trigger it.
• Typecheck and make build pass. Biome is clean on the changed files.
• Confirmed by hand that sbx exec exits 0 on a missing executable. Also confirmed that the new execInSandbox throws the expected SandboxError against a sandbox that's missing the mount.
• Not yet verified: a full eval run after sandbox update. That step needs the interactive OAuth login.