Make Docker sandbox the default runtime on GitHub-hosted runners

[lpcox]

Summary

Use the Docker sandbox (docker sbx) as the default runtime when an agentic workflow runs on a GitHub-hosted runner.

Desired behavior

• Detect execution on GitHub-hosted runners.
• Default to the Docker sandbox runtime in that environment.
• Preserve explicit runtime configuration as an override.
• Keep the existing default behavior for non-GitHub-hosted and self-hosted runners.

Acceptance criteria

• Workflows running on GitHub-hosted runners use Docker sandbox by default.
• An explicitly configured runtime continues to take precedence.
• Self-hosted and local execution behavior remains unchanged.
• Tests and user-facing documentation cover the new default.