feat(infra): install shellcheck v0.10.0 in the sandbox image

[debuggingfuture]

Runs that lint shell scripts find shellcheck v0.10.0 on PATH in the sandbox image.

• infra/Dockerfile.sandbox-demo gains a layer behind WITH_BUILD_TOOLS that downloads the upstream release archive for the build architecture (x86_64 or aarch64), verifies it with sha256sum -c against a pinned SHA-256, extracts only the shellcheck binary to /usr/local/bin, and removes the archive in the same layer. Any other architecture fails the build.
• xz-utils joins the build-tools package list; the base image ships no xz to unpack the .tar.xz archive.
• With WITH_BUILD_TOOLS=false the image is unchanged.

Validation:

• docker build --check -f infra/Dockerfile.sandbox-demo . parses clean; its one warning (InvalidBaseImagePlatform) is on the existing base FROM when checked from an arm64 host.
• Building the build-tools and shellcheck layers on the base image for linux/amd64 with WITH_BUILD_TOOLS=true passes the checksum (OK) and prints version: 0.10.0.

[flaredispatch-fractalboxdev]

⚠️ pr-review could not complete: { "step": "review", "cause": Error: ModelCallFailed: openai returned 429: {"success":false,"result":[],"messages":[],"error":[{"code":2003,"message":"Rate limited"}],"name":"AiGatewayError","httpCode":429,"internalCode":2003,"message":"Rate limited","description":"Rate limited"}, "summaryMd": undefined }

📋 View full logs & reviewed diff ↗

[debuggingfuture]

The ShellCheck archive digests match the published v0.10.0 release values. The linux/amd64 sandbox image builds with WITH_BUILD_TOOLS=true, and the built image runs ShellCheck 0.10.0 from PATH. No blocking code findings remain.

The version build argument remains paired with fixed digests by design: changing the version alone fails the checksum gate.