#941 Sandbox throughput: shell/code sandbox holds a worker slot for the full command and adds ~175ms per call

EARS: While a sandboxed tools.shell.run is running, the engine shall not hold a workflow worker slot for longer than the container start time. From #915: run_shell_in_sandbox is synchronous (container.wait up to timeout, default 300s). This was the reason #760's sandbox was disabled (569c79b). Measured p50 for echo ok: 0.9ms direct vs 176ms sandboxed (10 runs, api container, python:3.11-slim pinned digest). Options: ctx.defer + completion event from a supervisor, per-tenant concurrency cap via TokenGate, or RunFlow container jobs. Also: shell output streaming to DataShard is unavailable in sandbox mode (long activities lose live logs).