fix(sandbox): include CLI lifecycle scripts

- Copy the CLI cache-warming postinstall script before the Docker dependency install layer
- Include the script in the restricted Docker build context
- Add regression coverage for lifecycle-script ordering and context availability