fix(server): pause egress sidecar with sandbox

[luppyw]

Summary

• Pause the Docker sandbox container before its egress sidecar and resume the sidecar before the sandbox container so the complete data plane follows the sandbox lifecycle.
• Fail closed when an expected sidecar is missing, compensate for partial lifecycle failures, and preserve existing behavior for sandboxes without a sidecar.
• Add focused lifecycle tests and document the Docker pause/resume ordering.

Fixes #1422

Testing

• Not run (explain why)

• Unit tests

• Integration tests

• e2e / manual verification

• cd server && python -m pytest -p no:cacheprovider -q (1319 passed)

• cd server && ruff check

• cd docs && corepack pnpm docs:build

• Verified against real Docker containers sharing the sidecar network namespace: both containers paused together and returned to running after resume.

Pyright remains non-clean with 55 diagnostics outside the new lifecycle paths, primarily in generated schema calls and mixin host attributes.

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[luppyw]

@Pangjiping Could you please review this PR when you have time? If the changes look correct and the required checks pass, would you be willing to merge it? I will address any requested changes promptly.

简体中文

@Pangjiping 方便时能否帮忙审核一下这个 PR？如果修改没有问题且必要检查通过，麻烦帮忙合并；如果需要调整，我会及时跟进。