fix(sandbox): validate runtime command before launch — reject empty commands

[Karry2019web]

Summary

Validates that the command list is non-empty before mutating the agent state to STARTING. Previously, an empty command would cause subprocess.Popen to raise an OSError after state had already been set, resulting in inconsistent recovery.

Changes

• src/agent/runtime.py: AgentRuntime.start() now validates command is a non-empty list upfront. If empty, it raises ValueError immediately — before any state mutation or process creation.

Acceptance Criteria

• ✅ Empty commands are rejected before state is set to STARTING
• ✅ State remains STOPPED when validation fails
• ✅ Existing tests continued to pass
• ✅ Behavior is clearly documented by the validation guard

Verification

# Before: empty command changes state -> Popen raises -> CRASHED
# After:  empty command is rejected immediately with ValueError

Fixes #3939