Sandbox pods need EmptyDir /tmp for writable temp space

[savitharaghunathan]

Problem

Tools (harness, goose, etc.) that create temp files at runtime fail with permission denied when writing to /tmp in sandbox pods. The chmod 1777 /tmp in the Containerfile only sets permissions in the image layer — containerd's overlay FS does not always preserve these permissions, so /tmp can be read-only at runtime.

Solution

• Mount an EmptyDir volume at /tmp in every sandbox pod (controller change)
• Remove the now-redundant chmod 1777 /tmp from images/agent-base/Containerfile
• Add unit tests asserting the /tmp and workspace EmptyDir volumes exist

Done in

• Commit e32ded7 on token_revoc branch (part of the Harness: stage-aware Hub token revocation using workflow stage env vars #74 PR, but logically separate)