feat: standalone sandbox-proxy with test suite, SNI router, and CI

[clementblaise]

Summary

Establishes sandbox-proxy as a standalone repository for the Ridges inference proxy sidecar.
This proxy sits between miner agents and OpenRouter, enforcing cost budgets, model restrictions,
API key validation, and workspace safety policies. It runs as a Docker sidecar in both
Kubernetes Pods and Docker Compose task environments.

Architecture

The proxy has two entry points:

• HTTPS proxy (port 443/80) — A FastAPI application (main.py) that intercepts HTTP
  requests to the OpenRouter API. It validates the runtime API key against a pre-registered
  SHA-256 hash, checks that the OpenRouter workspace has logging/data-sharing disabled,
  enforces model restrictions, rewrites provider preferences (ZDR, Chutes), sanitizes request
  bodies to a known-safe field allowlist, tracks per-request costs against a USD budget, and
  returns 429 when the budget is exhausted.

• SNI router (port 15443) — A TCP-level router (sni_router.py) that reads TLS
  ClientHello messages to extract the SNI hostname. Traffic to openrouter.ai is forwarded to
  the local HTTPS proxy for policy enforcement. During the agent phase, all other egress is
  blocked. During the verification phase (signaled by a sentinel file), non-OpenRouter traffic
  is transparently tunneled to its destination without decryption.