Remove docker-sbx runtime from Daily Dashboard Language Spec Review workflow

[Copilot]

The Daily Dashboard Language Specification Review workflow was configured for docker-sbx, which hard-required Docker Hub credentials and caused runs to skip when DOCKER_USERNAME/DOCKER_PAT were not present. This PR switches the workflow off docker-sbx so it can run with the repository’s standard agent runtime and no Docker Hub secret dependency.

• Workflow source update

  • Removed the sandbox.agent.runtime: docker-sbx block from:
    • .github/workflows/daily-dashboard-language-spec-review.md

• Compiled workflow lock alignment

  • Updated .github/workflows/daily-dashboard-language-spec-review.lock.yml to match source intent:
    • Removed Docker Hub secret declarations (DOCKER_PAT, DOCKER_USERNAME)
    • Removed docker-sbx-specific setup/check/install/auth steps
    • Removed docker-sbx-specific job gating and failure wiring

• Contract coverage

  • Added focused unit assertions in tests/unit/workflow-contract.test.mjs to enforce:
    • no runtime: docker-sbx in source
    • no docker-sbx / Docker Hub secret references in the lock file

# before
sandbox:
  agent:
    id: awf
    runtime: docker-sbx

# after
# (sandbox runtime block removed)

• Fixes [aw] Daily Dashboard Language Specification Review is missing docker-sbx Docker Hub secrets #56