feat(runtime): add Tableau file tooling

[thanhnguyen4649]

What

• install unzip in the sandbox rootfs
• pin tableauhyperapi==0.0.26359, tableauserverclient==0.41, and tableau-parser==0.1.0
• verify TWBX extraction and Hyper create/read round trips
• refresh Fedora packages during image builds so patched runtime packages are included

Why

• Code Interpreter needs durable Tableau workbook/extract support in production
• the previous candidate exposed pending Fedora security updates for bluez-libs, curl, and libcurl

Test

• git diff --check
• bash tests/file_generation_runtime_static.sh
• bash -n build-packages.sh docker/package-init.sh tests/file_generation_runtime_static.sh
• Docker build: sandbox-runner-false
• isolated NsJail candidate: 17/17 file-generation checks pass, including .twbx extraction and Hyper round trip
• exact pins verified on Python 3.14.4
• dnf check-update --security --refresh: no remaining security updates
• Trivy: 0 fixable HIGH/CRITICAL in final language packages and Debian 13.4 sandbox rootfs

Risk

• package bundle grows because Tableau Hyper ships native binaries
• Fedora refresh can change final-layer package versions; the immutable candidate image was rebuilt and rescanned
• production deployment remains manual with package-tree backup and image rollback

Screenshots

• N/A

[thanhnguyen4649]

ARM64 compatibility follow-up: CI correctly exposed that tableauhyperapi==0.0.26359 has no Linux aarch64 wheel. Commit ba189d8 now gates Hyper to Linux x86_64 while keeping tableauserverclient==0.41 and tableau-parser==0.1.0 architecture-neutral. The production x86_64 candidate was rerun after this change and still passes TWBX extraction, Hyper create/read, and all 17 file-format checks.