ci: add sandbox-capabilities workflow for GitHub Actions smoke test

[kisernl]

Workflow-only PR so the sandbox-capabilities GitHub Actions pipeline can be exercised independently.

• Contains only .github/workflows/sandbox-capabilities.yml (mirrored from Add sandbox capabilities matrix benchmark and weekly workflow #321, but with the schedule trigger removed so it doesn't run weekly before the benchmark implementation lands).
• Supports workflow_dispatch with provider, iterations, concurrency, and publish inputs.
• Renders the provider × feature pass/fail matrix as a GitHub Step Summary even when publish is false.
• All uses: references are pinned to full commit SHAs, the collect job has no vault access, and user inputs are passed through env: to avoid shell template injection.

The benchmark implementation (benchmarks/sandbox/capabilities.bench.ts, result writer, merge logic, and bench:capabilities script) lives in #321. Merging that PR before the functional scheduled runs is required; this PR is for workflow syntax/matrix/smoke validation.

Link to Devin session: https://app.devin.ai/sessions/f98952f689154db886036dda3dd56bd1
Requested by: @kisernl

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[open-cla]

Contributor License Agreement

All contributors are covered by a CLA.

[superagent-security]

Superagent found 3 security concern(s).

[devin-ai-integration]

Devin Review found 4 potential issues.