Landing a PR that ships new sandbox tools injectables

Unblocks landing a PR that changed code under src/inspect_sandbox_tools/ and bumped the injectable version: builds the four artifacts (amd64/arm64 × glibc/musl) from the PR branch, validates them across Linux distros, publishes them to S3, and commits the pinned digests back to the PR branch.

The whole procedure is scripted as an interactive wizard:

scripts/release-sandbox-tools.sh [--dry-run] [--auto]