feat(sandbox): inject host gateway hostAliases into sandbox pods

[drew]

Summary

• Sandbox pods running in the k3s cluster cannot resolve host.docker.internal by default, preventing them from reaching services on the Docker host (e.g. local provider endpoints during development).
• Detects the host gateway IP (default route) in the cluster entrypoint script and threads it through the full config pipeline: entrypoint → HelmChart manifest → Helm values → gateway server env → SandboxClient → sandbox pod spec.
• Injects hostAliases entries (host.docker.internal, host.openshell.internal) into every sandbox pod spec so processes inside sandboxes can resolve the Docker host.
• The injection is conditional — when the IP is empty (non-Docker deployments), no hostAliases are added.

Changes

File	Change
deploy/docker/cluster-entrypoint.sh	Detect host gateway IP via ip route; inject into HelmChart via sed
deploy/kube/manifests/openshell-helmchart.yaml	Add hostGatewayIP: __HOST_GATEWAY_IP__ placeholder
deploy/helm/openshell/values.yaml	Add server.hostGatewayIP default
deploy/helm/openshell/templates/statefulset.yaml	Map to OPENSHELL_HOST_GATEWAY_IP env var
crates/openshell-core/src/config.rs	Add host_gateway_ip field + builder method
crates/openshell-server/src/main.rs	Add CLI arg / env var
crates/openshell-server/src/lib.rs	Pass to SandboxClient
crates/openshell-server/src/sandbox/mod.rs	Store on SandboxClient; inject hostAliases in both default and custom pod template paths

Test Plan

• 3 new unit tests added covering: hostAliases injected when IP set, not injected when empty, injected in custom pod templates
• All 162 existing openshell-server tests pass
• Full mise run pre-commit passes (format, lint, check, all workspace tests)