chore: switch sandbox image to stable Cortex channel when exec moves to GA

[kameshsampath]

Context

The sandbox Dockerfile currently uses CORTEX_CHANNEL=beta because cortex exec is only available in the beta channel. Once cortex exec is promoted to the stable (GA) channel, we should:

1. Change the default CORTEX_CHANNEL build arg in src/inspect_coco/sandbox/Dockerfile from beta to stable
2. Update the sandbox-image.yml workflow default from beta to stable
3. Rebuild and push the ghcr.io/kameshsampath/inspect-coco-sandbox:latest image
4. Update docs that reference the beta channel requirement

Files to change

• src/inspect_coco/sandbox/Dockerfile (ARG CORTEX_CHANNEL default)
• .github/workflows/sandbox-image.yml (env and input defaults)
• README.md (prerequisites section)
• docs/architecture.md (sandbox section)

How to verify

docker run --rm ghcr.io/kameshsampath/inspect-coco-sandbox:latest cortex exec --help

Should work without needing CORTEX_CHANNEL=beta.