build(integration): consume YuanRong 237 OBS wheels

[Chamberlain1998]

Purpose

This is a minimal integration PR for YuanRong Buildkite #237 and the checkpoint-capable sandboxd branch. The branch is ready for joint image-build and pause/resume validation with make build.

Pinned integration inputs

• YuanRong commit: 87cba622b491f7303415d179f3fa2fdae98e69e7 from Buildkite #237
• core OBS wheel SHA-256: 9eb44e1ea59153ab9a65a81fc32450c09376e835732290046d028cec2db3b200
• RRT OBS wheel SHA-256: 3aff1b4a676ca28992a2478adab900bc7bd1e76928cc12016ae50fea412a68c4
• sandboxd source: Chamberlain1998/sandboxd:codex/native-gvisor-checkpoint-v1
• sandboxd gitlink: 55971e14f533a79ac84d9e23ad455ca1e9d56c47

Scope

• Add checksum-verifying core and RRT wheel downloaders.
• Wire the downloaders into the existing node/runtime Dockerfiles.
• Pin the #237 non-release OBS URLs in this integration branch.
• Point the sandboxd submodule and gitlink at the checkpoint branch.
• Add focused downloader and build-argument tests.

This PR intentionally contains no AKernel Buildkite pipeline, PVC/cache, SDK, deployment, or unrelated documentation changes.

Current status

• Downloader behavior checks pass.
• make build forwards both #237 OBS URL/SHA pairs to the correct Docker builds.
• The sandboxd URL, remote branch tip, worktree HEAD, and staged gitlink all resolve to 55971e14....
• A previous ECS image build validated the same YuanRong #237 artifacts and sandboxd revision; this rebased minimal branch has not been rebuilt end to end.

The OBS objects are daily-build artifacts rather than durable release assets and are intended only for this integration window.