ci: stabilize optional Docker workbench smoke

[vibeforge1111]

Summary

• keep optional Docker dev smoke bounded to Docker/access/entrypoint checks plus CLI help
• align the optional sandbox workflow tmpfs ownership with the local sandbox wrappers
• document the bounded dev lane and add regression coverage for both defaults

Proof

• python -m pytest tests/test_access.py tests/test_docker_entrypoint.py -q
• python -m pytest -q
• git diff --check

Security

• no participant PR code was run on the publishing machine
• Docker remains optional/manual and no secrets are mounted
• sandbox lane keeps network off, read-only root, no-new-privileges, and no Linux capabilities