stdlib: migrate ecosystem .star files to unified sandbox tree shape (loader refactor needed)

[eliothedeman]

Follow-up from #444.

The bundled clash_starlark/stdlib/*.star ecosystem files (rust.star, python.star, node.star, go.star, java.star, ruby.star, swift.star, dotnet.star, make.star, docker.star, sandboxes.star) still call legacy sandbox(fs=..., net=...) at module load time.

The reason they couldn't be migrated as part of #444: module-level sandbox() calls during load(...) evaluation cannot currently access EvalContext to register against the active policy. _sandbox_impl requires an EvalContext from eval.extra, which is only attached at the top-level policy file.

Blocked on

Loader refactor that gives module-level constructors access to the registration context. Likely shape: thread EvalContext (or a registration handle) into ClashLoader so loaded modules can call _sandbox_impl and have it land in the same sandboxes map.

Can be deleted once unblocked

• _legacy_sandbox, _make_sandbox, _legacy_path_match, _legacy_glob, _path_match in clash_starlark/stdlib/std.star
• cwd(), home(), tempdir(), domains() (legacy plural) in std.star
• The fs=/net= dispatch branch in the new sandbox()
• The legacy struct path in clash_starlark/src/when.rs::sandbox_to_json

Acceptance

• All stdlib/*.star ecosystem files use the unified sandbox(name, tree, ...) form
• Legacy helpers above are deleted
• cargo test -p clash_starlark and cargo test -p clash pass