Fix direct sandbox merged-/usr startup and IPv6 binding

[LeonardSEO]

Summary

This PR addresses the concrete runtime issues that can be fixed without changing the storage or egress architecture:

• Fixes direct sandbox startup on merged-/usr images by binding the complete /usr tree once (issue Direct sandbox startup fails on merged /usr runner images #22).
• Adds explicit SANDBOX_BIND_HOST/bind_port handling so IPv6 listeners do not break on colon splitting (issue Allow for IPv6 clusters #23).
• Uses a populated /host-packages mount when available and keeps baked ROOTFS/pkgs as the fallback when the mount is empty or unavailable (partial issue [Feature Request] Add NsJail direct sandbox with baked pkgs #24).

Validation

• bash tests/start-direct-sandbox.test.sh
• bash -n docker/start-direct-sandbox.sh tests/start-direct-sandbox.test.sh
• npx --yes bun test api/src/config.test.ts
• git diff --check

Scope notes

Issue #25 appears to be an injection/lifecycle race in the LibreChat integration: the first execution arrives with zero injected files, while the second has the resource file. It is not reproducibly fixable in this repository from the issue evidence alone.

Issues #15, #21, #11, and #6 require separate upstream design or infrastructure work (virtio-fs/libkrun descriptor lifecycle, Flux-compatible chart sourcing, object-storage migration, and a policy-controlled egress gateway respectively).

References: #22, #23, #24, #25, #15, #21, #11, #6

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}