Refactor sandbox reset argument plumbing

[seanwevans]

Motivation

• Reduce duplicated keyword argument lists when (re)configuring sandbox threads by centralizing the resetable runtime options into a single serializable config shape.
• Make warm-pool reuse and single-thread reset paths intentionally mirror each other to avoid drift and maintenance errors.
• Preserve public Supervisor/Sandbox APIs while removing repetitive per-field plumbing across call sites.

Description

• Added SandboxThread.reset_config() to serialize only the runtime options consumed by reset (policy, quotas, imports, NUMA, capabilities, etc.).
• Added SandboxThread.apply_reset_config() to apply the serialized config and centralize field assignment logic.
• Updated SandboxThread.reset() to delegate runtime field assignment to apply_reset_config() while keeping the original reset(...) signature for API compatibility.
• Updated Sandbox.reset() and Supervisor.spawn() to build/use a single reset_config dict and pass it via **reset_config (with brief call-site comments noting the intentional mirroring).
• Changes are limited to pyisolate/runtime/thread.py and pyisolate/supervisor.py and preserve outward behavior of public methods.

Testing

• Compiled the modified modules with python -m compileall pyisolate/runtime/thread.py pyisolate/supervisor.py which succeeded.
• Ran the test suite with pytest -q but initialization failed in this environment due to an existing test harness/stub mismatch (_StubBPFManager.load() does not accept mode=), causing many supervisor-init failures unrelated to this refactor.
• No unit test failures were observed that are attributable to the reset-config refactor during local validation prior to the environment-specific stub error.

---

Codex Task