relay: audit every request line on a kept connection

[CMGS]

Second step of #195, the sandboxd side of a persistent data-plane connection; independent of #196 in code, motivated by it.

What changes

The audit tee in sandboxd/server/relay.go recorded the first client line and then degraded to a pass-through, on the premise that one connection carried one RPC. With silkd serving RPCs back to back on one connection (#196) it now scans every client line:

• request frames are recorded, as before;
• the input frames of the RPC in flight (stdin, stdin_close, data, data_end) are skipped by their canonical head, so an upload's 256 KB chunks never reach the journal;
• a request frame that outgrows the 4 KB AuditLineCap is recorded once as oversized, the same event the cap produced before;
• a trailing partial line is never recorded.

wire.IsContinuation names the head check on the shared wire package, next to the encoders that emit that head, so the relay and the SDKs agree on which frames open an RPC.

Docs: protocol/wire, the root README and docs/sandboxd-api.md drop the one-connection-per-RPC wording; the agent endpoint's doc now says that an open relay holds the sandbox's idle clock, which a client keeping a connection warm has to know for idle_hibernate_seconds to apply. Two stale comments (engine/silkd.go, pool/telemetry.go) follow.

Nothing else in the relay changes: the hold, the wake-on-dial, the drain grace and the half-close handling are as before.

Hot path

Without audit: unchanged, the tee is not installed. With audit: one IndexByte per relayed chunk and at most 4 KB copied per line, where only the first line was scanned before; the post-first-line io.Copy pass-through is gone, so an audited upload now flows through the tee's Read for its whole length.

Evidence

$ (cd protocol/wire && GOWORK=off go test -race -count=1 ./...)
ok  	github.com/cocoonstack/sandbox/protocol/wire	1.398s
$ (cd sandboxd && GOWORK=off go test -race -count=1 ./server/ ./pool/ ./engine/)
ok  	github.com/cocoonstack/sandbox/sandboxd/server	2.479s
ok  	github.com/cocoonstack/sandbox/sandboxd/pool	4.017s
ok  	github.com/cocoonstack/sandbox/sandboxd/engine	4.079s
$ make go-lint | grep -c "0 issues."
10
$ (cd protocol/wire && GOWORK=off asl ./...)          # clean
$ (cd sandboxd && GOWORK=off asl ./server/ ./pool/ ./engine/)
pool/hibernate.go:329, pool/pool.go:203, pool/pool.go:697   # pre-existing forwarder advisories, files untouched here

TestAuditTeeRecordsRequestLines drives the tee whole and one byte at a time: requests back to back, an upload with a 12 KB data chunk, stdin frames, an oversized request, a partial tail. TestIsContinuation pins the predicate to the package's own encoders.