ci(sandbox): run real Docker containment tests

[Jake Present (jakepresent)]

Problem

ASSERT's real Docker sandbox tests are guarded by ASSERT_RUN_DOCKER_TESTS=1, but no automated workflow sets that variable. The normal unit workflow collects the file and silently skips all four live containment tests.

Fix

Add a path-scoped GitHub Actions workflow that:

• installs ASSERT's test dependencies on Ubuntu/Python 3.11
• enables and runs tests/test_sandbox_runtime_docker.py
• triggers for sandbox runtime, inference integration, example, test, dependency, and workflow changes
• always checks for leftover target/relay containers and networks, including after test failure

Verification

• Workflow YAML parses successfully.
• The repository's exact Docker suite command is encoded in the workflow.
• Live execution will be verified from this PR's GitHub Actions run; local clean-image execution is currently blocked before product code by the local Docker builder's PyPI TLS handshake failure.

Follow-up

The current repository ruleset requires PR review but does not require status checks. Once this workflow has a stable check context, the repository ruleset can make Sandbox: real Docker containment a required check for matching changes.