Repair stale sandbox helper cache entries

[ShravanSunder]

Fixes #116.

Summary

• Treat sandbox-helper object directories as content-addressed cache objects: the registry-selected build id is the authority.
• When strict cache validation fails only because helper metadata such as manifest.gondolinVersion drifted, reuse the cached object if its computed build id still matches the selected registry source.
• Avoid deleting, quarantining, or redownloading an otherwise usable helper object, so transient registry/archive failures do not turn a warm cache into a hard failure.
• Add a regression test for the 0.9.1 -> 0.12.0 same-build-id case and assert no archive fetch or stale/tmp object directories are produced.

Validation

• PASS: node --test host/test/sandbox-helpers.test.ts (10 tests)
• PASS: make -C host typecheck
• PASS: make -C host build
• PASS: git diff --check
• NOTE: make -C host test currently has one unrelated failure in host/test/exec.test.ts: deleteFile rejects recursive missing paths without force (Missing expected rejection). The new sandbox-helper test passes in the full run.