fix: make site CLI setup sandbox-safe

[mfzzf]

Summary

• update the SDK pin so all CLI HTTP paths honor environment proxies
• make the POSIX installer use an explicit TMPDIR/ucloud-sandbox-cli.XXXXXXXX template
• route AstraFlow setup through the managed ensure_ucloud_sandbox_cli tool
• require CLI v1.3.1 and combine connection verification with the initial directory check
• prevent host escalation loops on proxy failures

Verification

• go test ./...
• sh -n install.sh
• git diff --check