Fix local sandbox startup and show sandbox image

[RyanLee-Dev]

Summary

• enable the Docker sandbox backend by default when starting the server through with-dev-env.sh
• expose the configured Docker sandbox image through runtime status
• show the actual sandbox image in the New Agent cloud-isolation configuration
• add backend coverage, localized copy, and regenerate OpenAPI

Validation

• focused Go tests pass
• web TypeScript typecheck passes
• git diff --check passes
• make check reaches the existing order-dependent TestGetEnabledCapabilitiesForAgent_LatestFreezesOnDeprecation failure; that test passes independently with -count=3

Note

• an unrelated local docker-compose.yml modification was intentionally excluded from this PR.