ci: pytest runs with the hunt and semantic extras kept; sandbox tests skip by cause where no bwrap exists

CI's first full pytest run since 2836b78 showed 65 failures in three classes. uv run re-synced the environment
to the lockfile's default extras before pytest, removing dspy again (UV_NO_SYNC=1 now). The learn slice, pair
corpus and hunt producer tests need tree-sitter (semantic extra installed). Thirty-two tests need bubblewrap
isolation, which CI's container cannot provide: they carry a sandbox marker and skip where the isolation
preflight fails, with the cause's type in the reason; proven locally by hiding bwrap (7 skipped, 23 passed).
The partial-clone extraction test now probes one lazy fetch through git itself first, so git's own stderr
reaches the next CI log instead of git_exit_128.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/test_search_pilot_run.py

@@ -11,6 +11,7 @@ from benchmarks.search.pilot_run import main
 
 
 @pytest.mark.parametrize("side,outcome", [("vulnerable", "demonstrated"), ("fixed", "inconclusive")])
+@pytest.mark.sandbox
 def test_probe_pilot_end_to_end(tmp_path, capsys, side, outcome):
     output = tmp_path / "records.jsonl"
     assert (
@@ -231,6 +232,7 @@ def test_shared_budget_reserved_and_settled_on_error(tmp_path):
 
 
 @pytest.mark.parametrize("verify_lane", ["vm", "ax"])
+@pytest.mark.sandbox
 def test_live_wiring_with_fake_mailbox_no_network(tmp_path, monkeypatch, verify_lane):
     import shutil
     from dataclasses import asdict
@@ -567,6 +569,7 @@ def test_live_driver_stops_remaining_pairs_on_infrastructure_failure(tmp_path, m
 
 
 @pytest.mark.parametrize("oracle", ["sql", "command"])
+@pytest.mark.sandbox
 def test_injection_pilot_uses_demo_choice_without_manifest_subtype(tmp_path, oracle):
     from openultrasast.search.probe import materialise