Add ephemeral scratch disk with overlayfs

[danievanzyl]

Summary

• Adds scratch_size_mib param to POST /sandboxes — creates a sparse ext4 as /dev/vdb
• Agent mounts at /scratch and layers overlayfs on /usr, /var, /etc
• apt install, pip install, npm install all write to scratch transparently
• Rootfs stays pristine, scratch is destroyed with the sandbox

Test plan

• Create sandbox with scratch_size_mib=1024 — /scratch mounts as 974MB
• overlayfs active on /usr, /var, /etc
• pip install flask writes to scratch overlay, imports work
• Sandbox without scratch still works (no regression)