ci: pytest runs with the hunt and semantic extras kept; sandbox tests skip by cause where no bwrap exists

CI's first full pytest run since 2836b78 showed 65 failures in three classes. uv run re-synced the environment
to the lockfile's default extras before pytest, removing dspy again (UV_NO_SYNC=1 now). The learn slice, pair
corpus and hunt producer tests need tree-sitter (semantic extra installed). Thirty-two tests need bubblewrap
isolation, which CI's container cannot provide: they carry a sandbox marker and skip where the isolation
preflight fails, with the cause's type in the reason; proven locally by hiding bwrap (7 skipped, 23 passed).
The partial-clone extraction test now probes one lazy fetch through git itself first, so git's own stderr
reaches the next CI log instead of git_exit_128.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

pyproject.toml

@@ -52,6 +52,7 @@ pythonpath = ["src"]
 markers = [
     "docker: requires a docker daemon",
     "semantic: requires openultrasast[semantic] tree-sitter extra",
+    "sandbox: needs bubblewrap isolation; skipped where the isolation preflight fails (CI's container has no bwrap)",
     "ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
 ]