sandbox: run tini as PID 1 (init: true) so Chromium zombies get reaped

Docker sandboxes run `sleep infinity` as PID 1. `sleep` never wait()s
on re-parented children, so Chromium's short-lived helper/crashpad
processes accumulate as zombies in long-lived browser sandboxes. With
`pids_limit` set, this eventually exhausts the slot and the container
can no longer fork — the browser tool starts failing before it looks
"unhealthy" anywhere else.

Setting HostConfig.init = Some(true) makes Docker inject tini, which
reaps re-parented children.

Note: existing sandbox containers keep their old spec (init is set at
create time). Cycle them post-deploy to pick up tini.

crates/cm-sandbox/src/docker.rs

@@ -133,6 +133,11 @@ impl SandboxDriver for DockerDriver {
             memory: Some(spec.memory_bytes),
             nano_cpus: Some(spec.nano_cpus),
             pids_limit: Some(spec.pids_limit),
+            // Run tini as PID 1 so it reaps re-parented children (Chromium
+            // spawns short-lived helper/crashpad processes). `sleep infinity`
+            // never wait()s, so without this they accumulate as zombies and
+            // eventually exhaust `pids_limit` in long-lived browser sandboxes.
+            init: Some(true),
             ..Default::default()
         };
         let body = ContainerCreateBody {