Fix direct sandbox merged-/usr startup and IPv6 binding

[LeonardSEO]

Summary

This PR addresses the concrete runtime issues that can be fixed without changing the storage or egress architecture:

• Fixes direct sandbox startup on merged-/usr images by binding the complete /usr tree once (issue Direct sandbox startup fails on merged /usr runner images #22).
• Adds explicit SANDBOX_BIND_HOST/bind_port handling so IPv6 listeners do not break on colon splitting (issue Allow for IPv6 clusters #23).
• Uses a populated /host-packages mount when available and keeps baked ROOTFS/pkgs as the fallback when the mount is empty or unavailable (partial issue [Feature Request] Add NsJail direct sandbox with baked pkgs #24).

Validation

• bash tests/start-direct-sandbox.test.sh
• bash -n docker/start-direct-sandbox.sh tests/start-direct-sandbox.test.sh
• npx --yes bun test api/src/config.test.ts
• git diff --check

Scope notes

Issue #25 appears to be an injection/lifecycle race in the LibreChat integration: the first execution arrives with zero injected files, while the second has the resource file. It is not reproducibly fixable in this repository from the issue evidence alone.

Issues #15, #21, #11, and #6 require separate upstream design or infrastructure work (virtio-fs/libkrun descriptor lifecycle, Flux-compatible chart sourcing, object-storage migration, and a policy-controlled egress gateway respectively).

References: #22, #23, #24, #25, #15, #21, #11, #6

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[danny-avila]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5290dbd91b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow SANDBOX_BIND_HOST through the microVM launcher

When this chart runs with the default workerSandbox.kvmEnabled: true, this new env var is set only on the outer sandbox-runner container; the microVM guest receives only variables allowed by launcher/src/main.rs:is_allowed_guest_env_key, and that allowlist currently includes PORT but not SANDBOX_BIND_HOST. As a result, setting workerSandbox.sandbox.bindHost: "::" for an IPv6-only cluster is silently dropped before api/src/config.ts runs, so the sandbox API still binds 0.0.0.0 unless KVM is disabled or the launcher allowlist is updated.

Useful? React with 👍 / 👎.