ci: split run-action e2e tests by case and consolidate integration tests

[dash14]

Summary

The run action's audit-mode restrict-mode-example feature (#170) had no e2e coverage — test-e2e.yml's test_sandbox job never exercised proxy_mode: audit. Digging into why turned up a related gap: run/src/main.js's actionRef/actionRepo fell through to "" (not report/src/main.js's "v2"/"dash14/buildcage" defaults) when invoked via a local path (uses: ./run, as this repo's own e2e tests do), so a local audit-mode run would render a broken-looking uses: /run@ in the generated example instead of something an assertion could actually check.

While adding audit-mode coverage, the sandbox e2e/integration tests were also restructured. test_sandbox's cases (enforcement, writable, fail_on_blocked, concurrency) had been splitting into ever more jobs, each repeating the same checkout/build/rebuild boilerplate, even though only one representative case per input actually needs the real action wrapper. The rest — writable: value variations, privilege-drop/filesystem defaults, direct concurrent proxy lifecycles — don't depend on the action wrapper at all, so they've moved to test-integration.yml as real shell scripts under run/test/, run via a single make test_sandbox_integration target instead of one GitHub Actions job apiece.

Changes

• Fix run/src/main.js's actionRef/actionRepo fallback (?? → ||, with "v2"/"dash14/buildcage" defaults) to mirror report/src/main.js's handling of local-path uses: ./run invocations
• Trim verbose comments in core/lib/build-example.js
• Restructure test-e2e.yml's sandbox jobs — test_sandbox_audit_mode (new, placed first) verifies the restrict-mode example renders in the Job Summary; test_sandbox_enforcement now also covers one writable: pattern in the same run invocation instead of a separate job; test_sandbox_fail_on_blocked and test_sandbox_concurrency are unchanged
• Consolidate test-integration.yml's sandbox jobs into one (test_sandbox), driving run/dist/main.cjs directly via make test_sandbox_integration and new/renamed scripts under run/test/ (integration-test-writable-dir.sh, integration-test-writable-disabled.sh, integration-test-defaults.sh, integration-test-concurrent.sh — the last renamed from assert-sandbox-concurrent.sh)
• Add the test_sandbox_integration Makefile target and update docs/development.md's Makefile command table and stale job references