feat(sandbox): migrate declared egress policies

[drewstone]

Summary

• Adds an explicit migrateEgressPolicy option to the shared sandbox shell.
• Updates an existing box in place only when a product opts in, then reads the policy back before reuse.
• Keeps the default mismatch behavior fail-closed and never deletes a box during migration.
• Exports the shared Python package-registry host set so products do not duplicate it.
• Regenerates the sandbox API documentation.

Proof

• pnpm test:gates — 6 files, 302 tests passed
• pnpm typecheck — passed
• pnpm docs:gen — passed
• git diff --check — passed
• git merge-tree --write-tree origin/main HEAD — passed

[tangletools]

✅ Auto-approved drewstone PR — c66cc148

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-04T05:33:52Z}