feat: install @ai-hero/sandcastle + minimal Dockerfile

.sandcastle/Dockerfile

@@ -0,0 +1,14 @@
+# Minimal sandbox for sandcastle dispatch.
+# Will be extended once the CI image is identified (see ADR-future).
+FROM node:22-bookworm-slim
+
+# pnpm via corepack (matches the repo's pnpm version)
+RUN corepack enable && corepack prepare pnpm@9 --activate
+
+WORKDIR /workspace
+
+# Repo files are mounted by sandcastle at /workspace at runtime.
+# The agent runs `pnpm install --frozen-lockfile` as its first step
+# per the implementer prompt template.
+
+CMD ["bash"]