fix(dev): extract Docker sandbox runtime from sandbox image

[johntmyers]

Summary

Fix mise run gateway:docker on macOS and other cross-compilation hosts after the supervisor/runtime split in #2942. Setup exported the supervisor image and then failed copying openshell-sandbox, because that image now contains openshell-supervisor. Extract the workload runtime from the sandbox image instead.

Related Issue

No issue required: an obvious localized correction to the Docker development build target after #2942.

Changes

• Select the sandbox Docker build target when exporting openshell-sandbox for the local Docker driver.
• Correct the extraction comment and document the separate runtime/supervisor artifact contract in the architecture overview and troubleshooting skill.

Testing

• mise run pre-commit passes
• bash -n tasks/scripts/gateway-docker.sh
• bash tasks/scripts/test-gateway-pull-policy.sh
• ARM64 sandbox image export using an existing staged binary: extracted binary matches the input, is statically linked, and executes --version in a container.
• Live macOS Docker Desktop smoke test after restarting mise run gateway:docker from this worktree: sandbox reached Ready, workload ran exactly once, supervisor was healthy, both containers had zero restarts, CLI exec succeeded as non-root, and deletion removed both containers.

No new unit tests: the change selects the existing sandbox build target. Full local CI was not run; remote CI will provide broader coverage.

Checklist

• Follows Conventional Commits
• Commit is signed off (DCO)
• Architecture and troubleshooting documentation updated