ci: pytest runs with the hunt and semantic extras kept; sandbox tests skip by cause where no bwrap exists

CI's first full pytest run since 2836b78 showed 65 failures in three classes. uv run re-synced the environment
to the lockfile's default extras before pytest, removing dspy again (UV_NO_SYNC=1 now). The learn slice, pair
corpus and hunt producer tests need tree-sitter (semantic extra installed). Thirty-two tests need bubblewrap
isolation, which CI's container cannot provide: they carry a sandbox marker and skip where the isolation
preflight fails, with the cause's type in the reason; proven locally by hiding bwrap (7 skipped, 23 passed).
The partial-clone extraction test now probes one lazy fetch through git itself first, so git's own stderr
reaches the next CI log instead of git_exit_128.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/test_search_probe.py

@@ -131,6 +131,7 @@ def test_oracle_namespace_failure_is_instrument_failure(tmp_path, monkeypatch):
 
 
 @pytest.mark.parametrize("execution", ["real", "stubbed"])
+@pytest.mark.sandbox
 def test_task_boundary_probe_executes_packaged_pairs(tmp_path, monkeypatch, namespace_diagnostics, execution):
     if execution == "real":
         import socket
@@ -202,6 +203,7 @@ def test_task_boundary_real_local_oracles(tmp_path, family):
     assert all(len(side.runs) == 3 for side in result.sides)
 
 
+@pytest.mark.sandbox
 def test_task_boundary_xss_uses_browser_mode(tmp_path, monkeypatch):
     from openultrasast.search.oracles import BrowserExecutor