feat(sessions): SandboxFleet integration — fleet controller primary, SandboxManager fallback

FleetClient calls tool-definition-controller:8788 /sessions/{id}/assign
as the primary sandbox create path. Falls back to direct k8s SandboxManager
if fleet controller is unreachable.

handleSandboxCreate:
  1. fleet.Assign() → podSvcDns from pre-warmed fleet pod (fast, no wait)
  2. fallback: sandbox.CreateOrResume() → dedicated pod (slow, 30s wait)

handleSandboxDelete: fleet.Release() + sandbox.Delete() both run (non-fatal).
updateSandboxSummary: extracted helper, updates session memory_entity with
  pod_name / svc_dns / last_active_at.

NetworkPolicy: added port 8788 to poimen egress (fleet controller REST API).

Response adds fleet:true field when served by fleet.

k8s/network-policy.yaml

@@ -122,7 +122,7 @@ spec:
     ports:
     - protocol: TCP
       port: 7233
-  # Allow to Poimen (memory:8080 + graphql:8090 + redis:6379)
+  # Allow to Poimen (memory:8080 + graphql:8090 + redis:6379 + fleet-controller:8788)
   - to:
     - namespaceSelector:
         matchLabels:
@@ -134,6 +134,8 @@ spec:
       port: 8090
     - protocol: TCP
       port: 6379
+    - protocol: TCP
+      port: 8788
   # Allow to Gotify (push notifications)
   - to:
     - namespaceSelector: