fix(sandbox): use /bin/sh instead of /bin/bash for reclaim compatibility

Changes /bin/bash to /bin/sh in StartEnvdBash to support minimal guest images that only include sh. The reclaim commands (sync, drop_caches, compact_memory, fstrim) are already shell-compatible and the script uses 'sh -c' internally, so this change ensures reclaim works on all guest images.

Fixes bug 146da99c-5417-4779-ac7c-c26ef1542a93

Author: cursoragent

packages/orchestrator/pkg/sandbox/envd_process.go

@@ -16,7 +16,7 @@ import (
 )
 
 // StartEnvdBash opens a streaming Process.Start call against this
-// sandbox's envd, running `/bin/bash` with the given args as `user`.
+// sandbox's envd, running `/bin/sh` with the given args as `user`.
 // Caller chooses login-shell vs. plain (e.g. []{"-l","-c",cmd} vs.
 // []{"-c",script}). When timeout > 0 it sets `Connect-Timeout-Ms` so
 // envd kills the process at the deadline. Auth/user headers are wired
@@ -31,7 +31,7 @@ func (s *Sandbox) StartEnvdBash(
 	pc := processconnect.NewProcessClient(&http.Client{Transport: sandboxHttpClient.Transport}, addr)
 
 	req := connect.NewRequest(&process.StartRequest{
-		Process: &process.ProcessConfig{Cmd: "/bin/bash", Args: bashArgs},
+		Process: &process.ProcessConfig{Cmd: "/bin/sh", Args: bashArgs},
 	})
 	if timeout > 0 {
 		req.Header().Set("Connect-Timeout-Ms", strconv.FormatInt(timeout.Milliseconds(), 10))