fix: require sandbox local runtime opt-in

[wolfkill]

Summary

Fixes #3082.

This PR prevents the sandbox runtime factory from silently falling back to host-local execution when no container backend is available.

Changes:

• Default SANDBOX_RUNTIME to auto instead of local.
• In auto mode, select Docker, Podman, or Nerdctl when available.
• Fail closed when no container runtime is available.
• Keep trusted local development compatibility through explicit SANDBOX_RUNTIME=local or RuntimeFactory.create(runtime_preference="local").
• Document the new safe default and local-runtime opt-in behavior.
• Format react_parser.py and its tests because the repository CI runs full-package make fmt-check and those files were already blocking Python Code Quality Checks on current PR branches.

Verification

• PYTHONPATH=packages/dbgpt-sandbox/src .venv/bin/python -m pytest packages/dbgpt-sandbox/src/dbgpt_sandbox/sandbox/execution_layer/tests/test_runtime_factory.py -q -> 6 passed
• SANDBOX_RUNTIME=local PYTHONPATH=packages/dbgpt-sandbox/src .venv/bin/python - <<PY ... PY -> explicit local runtime created a session and executed harmless Python successfully
• PYTHONPATH=packages/dbgpt-core/src .venv/bin/python -m pytest packages/dbgpt-core/src/dbgpt/agent/util/tests/test_react_parser.py -q -> 24 passed
• make fmt-check -> passed
• PYTHONPATH=packages/dbgpt-sandbox/src .venv/bin/python -m compileall -q ... -> passed
• git diff --check -> passed