Improve docker agent sbx

[dgageot]

No description provided.

[docker-agent]

Assessment: 🟢 APPROVE

The changes look correct and well-structured. Reviewed the following files:

• cmd/root/sandbox.go — sandbox startup / host allowlist wiring
• cmd/root/sandbox_test.go — sandbox tests
• pkg/environment/sandbox_tokens.go — token file handling
• pkg/environment/sandbox_tokens_test.go — token tests
• pkg/sandbox/kit/kit.go — kit manifest / path helpers
• pkg/sandbox/sandbox.go — sandbox lifecycle
• pkg/toolinstall/hosts.go — per-toolset host resolution
• pkg/toolinstall/hosts_test.go — host resolution tests

No bugs, logic errors, nil-pointer risks, resource leaks, or security issues were identified in the newly added code (+ lines). Error handling is consistent with existing project patterns, and the new host-allowlist and token-file changes follow the conventions established in prior commits.