Omit sudo from generated lock.yml when network-isolation sandbox is enabled

## Summary

When the AWF **network-isolation** sandbox option is enabled (`sandbox.agent.network-isolation: true`), the compiler still emits `sudo` in the generated `.lock.yml` for the awf binary install and the `awf` invocation. In network-isolation mode, AWF no longer needs `NET_ADMIN`/host-iptables egress enforcement, so it can run **rootless** — a key requirement for ARC (Actions Runner Controller) Kubernetes runners where passwordless `sudo`/host-iptables are often unavailable.

The compiler should **omit `sudo` from the generated lock when network-isolation is enabled**.

## Current behavior

For a workflow with `sandbox.agent.network-isolation: true`, the generated lock contains (line numbers from a real compile):

```yaml
# Install awf binary
sudo tee /usr/local/bin/awf > /dev/null < /dev/null <