Fix sandbox remapping and plugin version resolution

[ahmedhesham6]

Description

Improve sandbox startup behavior for host-mounted files and make plugin resolution use stable, explicit versions.

Related Issues

None

Changes Made

• add a container entrypoint + gosu flow so sandbox containers can remap to the host UID/GID without mapping root into the sandbox
• update autopilot/systemd startup to handle docker-group access via sg and add quoting/round-trip test coverage
• pin plugin downloads to resolved versions, prefer the server version for warden, and update plugin configs to pass the new resolution flag
• treat local provider credentials as valid auth so onboarding does not run unnecessarily when provider keys are already configured

Testing

• cargo fmt --all -- cli/src/commands/auto_update.rs cli/src/commands/autopilot/mod.rs cli/src/commands/board.rs cli/src/commands/browser.rs cli/src/commands/warden.rs cli/src/main.rs cli/src/utils/plugins.rs libs/server/src/sandbox.rs
• cargo clippy -p stakpak -p stakpak-server --all-targets -- -D warnings
• sh -n scripts/entrypoint.sh
• Tested on Linux/macOS/Windows (specify which)

Screenshots (if applicable)

N/A

Breaking Changes

None