Add Pi agent support to sandboxy

[AntApper]

Resolves #801

Overview

Adds built-in agent support for Pi (@earendil-works/pi-coding-agent) to sandboxy. This serves as a second built-in agent definition alongside Claude Code, validating the multi-agent application architecture.

Changes

• Adds AgentDefinition.pi configured with:
  • Base image docker.io/library/node:22
  • NPM installation of @earendil-works/pi-coding-agent with --ignore-scripts
  • Mount for ~/.pi/agent to /root/.pi/agent
  • Automatic forwarding for provider credentials (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, OPENROUTER_API_KEY, XAI_API_KEY, ANTHROPIC_OAUTH_TOKEN)
  • Allowed host domains for provider endpoints and npm
• Conditions global-agent proxy bootstrapping in RunAgentCommand so it is only applied when global-agent is present in the agent's install commands.
• Cleans up sigwinchStream on exit in runContainerSession.
• Updates sandboxy README documentation and usage examples.

Verification

• Built sandboxy binary and verified clean compilation (make -C examples/sandboxy).
• Ran code formatting (make fmt) and license/linter checks (make check).
• Ran the full test suite (swift test, 593 tests passed).
• Verified sandboxy config list --agents and interactive launch with PTY relay.