ci: pytest runs with the hunt and semantic extras kept; sandbox tests skip by cause where no bwrap exists

CI's first full pytest run since 2836b78 showed 65 failures in three classes. uv run re-synced the environment
to the lockfile's default extras before pytest, removing dspy again (UV_NO_SYNC=1 now). The learn slice, pair
corpus and hunt producer tests need tree-sitter (semantic extra installed). Thirty-two tests need bubblewrap
isolation, which CI's container cannot provide: they carry a sandbox marker and skip where the isolation
preflight fails, with the cause's type in the reason; proven locally by hiding bwrap (7 skipped, 23 passed).
The partial-clone extraction test now probes one lazy fetch through git itself first, so git's own stderr
reaches the next CI log instead of git_exit_128.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/test_search_browser.py

@@ -17,6 +17,7 @@ def test_browser_launch_failure_is_not_negative(monkeypatch):
 
 
 @pytest.mark.skipif(not (shutil.which("chromium") or shutil.which("chromium-browser")), reason="chromium not installed")
+@pytest.mark.sandbox
 def test_real_browser_executes_not_reflects():
     browser = BrowserExecutor()
     payload = '<script>alert("ousast-xss")</script>'
@@ -34,6 +35,7 @@ def test_real_browser_executes_not_reflects():
 
 
 @pytest.mark.parametrize("executed", [False, True])
+@pytest.mark.sandbox
 def test_marker_is_dom_attribute_not_source_text(monkeypatch, executed):
     import re
     from urllib.parse import unquote