Limit sandbox tool permission changes

[wsr3005]

Summary

• set executable mode on each copied sandbox tool with COPY --chmod=0755
• stop recursively changing permissions on the base image's /usr/local/bin
• cover the generated Dockerfile contract in unit and CLI end-to-end tests

Verification

• Node 24 sandbox build unit and CLI end-to-end tests: 15 passed
• CLI typecheck, ESLint, Prettier, and diff check
• real Buildx build of a synthetic sandbox layer
• local sandbox image build and live cold-start, warm-restart, persistence, and scratch smoke test

No rendered UI changes.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}