feat(api): return sandbox IP from start

[WenYuLuo]

Summary

Return the sandbox network address from StartResponse as sandbox_ip. This lets FunctionSystem publish and retire Node Proxy routes without exposing bridge-specific names or endpoint generation tokens. Port mappings remain caller-owned input in StartRequest and are not echoed in the response.

The branch is rebased on the current main, which already contains the patched gVisor runtime pin.

Interface changes

Adds sandbox_ip = 4 to StartResponse. Port mappings remain in StartRequest and ListSandboxes; StartResponse does not duplicate them.

Validation

• go test ./api/runtime/v1 ./internal/server
• generated protobuf descriptor contract updated with the pinned toolchain
• consumed successfully by openYuanRong Buildkite #182 full X86 build
• openYuanRong Buildkite #183 passed all 21 jobs with the data plane, sandbox package and Test K8S enabled
• after review, redundant StartResponse port echoing was removed; the targeted Go API/server tests passed, and the final cross-repository rebuild is deferred as requested

Signed-off-by: robbluo luo1442@gmail.com