Add sandbox template image with Claude configuration and plugins

Carries CLAUDE.md, AGENTS.md, hooks and skills verbatim from the host, plus a
manifest of the 10 marketplaces and 17 plugins to reinstall at build time. The
plugin directories themselves are not committed: ~/.claude/plugins is 831 MB and
sits alongside credentials and transcripts, so the image is reproduced from the
manifest instead and the build needs no access to the host.

The Gitea registry is behind Cloudflare, which rejects request bodies over 100 MB
against a base image with a 325 MB layer, so the workflow pushes chunked through
regctl rather than docker push.

sbx v0.37.0 and v0.37.1 cannot consume the result: layers stacked on the base are
silently dropped (docker/sbx-releases#366). The image builds and pushes correctly
and is a no-op at runtime until that is fixed, so README points at
'ai:sbx setup' as the mechanism that works today.

scripts/install-plugins.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+
+manifest="${1:-plugins.json}"
+
+[[ -f "$manifest" ]] || {
+    printf 'install-plugins: no manifest at %s\n' "$manifest" >&2
+    exit 1
+}
+
+marketplace_count=0
+while read -r url; do
+    [[ -n "$url" ]] || continue
+
+    printf '==> marketplace %s\n' "$url"
+    claude plugin marketplace add "$url" </dev/null
+    marketplace_count=$((marketplace_count + 1))
+done < <(jq -r '.marketplaces | to_entries[] | .value' "$manifest")
+
+plugin_count=0
+while read -r plugin; do
+    [[ -n "$plugin" ]] || continue
+
+    printf '==> plugin %s\n' "$plugin"
+    claude plugin install "$plugin" </dev/null
+    plugin_count=$((plugin_count + 1))
+done < <(jq -r '.plugins[]' "$manifest")
+
+printf 'Installed %d marketplaces and %d plugins.\n' \
+    "$marketplace_count" "$plugin_count"
+
+installed="$(claude plugin list 2>/dev/null | grep -c 'enabled' || true)"
+
+[[ "$installed" -eq "$plugin_count" ]] || {
+    printf 'install-plugins: expected %d enabled plugins, found %d\n' \
+        "$plugin_count" "$installed" >&2
+    exit 1
+}