Harden GenPlan container runtime

[joshnroy]

Hardens the GenPlan sandbox staging path for 3D Kindergarden environments.

Changes:

• Skip bulky Kindergarden mesh/texture asset directories when copying the source tree into per-run staging directories.
• Bind-mount those asset directories read-only at their expected in-container paths for Docker and Apptainer.
• Keep blackbox behavior isolated by omitting these source-adjacent assets in blackbox sandboxes.

Why:

• Copying these assets into every per-replicate sandbox can exhaust /tmp or quota during multi-seed 3D GenPlan runs.
• Read-only mounts preserve the in-container paths expected by Kindergarden without duplicating large static assets.

Verification:

• uv run black --check src/robocode/utils/docker_sandbox.py src/robocode/utils/apptainer_sandbox.py tests/utils/test_docker_sandbox.py tests/utils/test_apptainer_sandbox.py
• uv run isort --check-only src/robocode/utils/docker_sandbox.py src/robocode/utils/apptainer_sandbox.py tests/utils/test_docker_sandbox.py tests/utils/test_apptainer_sandbox.py
• uv run pytest tests/utils/test_docker_sandbox.py::test_kindergarden_copy_excludes_large_assets tests/utils/test_docker_sandbox.py::test_docker_run_prefix_mounts_kindergarden_assets_read_only tests/utils/test_apptainer_sandbox.py::test_build_cmd_mounts_kindergarden_assets_read_only -q

[joshnroy]

Folded into #177 so Claude session reuse and the container wall-clock limit can be reviewed together as one runtime reliability change.