compiler: schema validator rejects sandbox.agent.sudo: false (schema not updated to match Go struct rename)

## Problem

The Go struct `AgentSandboxConfig` in `pkg/workflow/sandbox.go` already has the renamed field:

```go
NetworkIsolation bool `yaml:"sudo,omitempty"` // sudo: false => NetworkIsolation=true
```

And changeset `minor-rename-network-isolation-to-sudo.md` documents the migration:

> Replace `sandbox.agent.network-isolation: true` with `sandbox.agent.sudo: false`

However, `gh aw compile` rejects `sandbox.agent.sudo: false` with:

```
Unknown property: sudo. Valid fields are: agent, config, mcp, type
```

The JSON Schema / parser schema in `pkg/parser/schema_compiler.go` has **not** been updated to include `sudo` as a valid property of `sandbox.agent`. The YAML struct and the schema are out of sync.

## Impact

Any workflow frontmatter using `sandbox.agent.sudo: false` (the documented new syntax) fails to compile on all current versions including `main`.

**Repro** (`githubnext/gh-aw-test`): [`test-copilot-network-isolation.md`](https://github.com/githubnext/gh-aw-test/blob/main/.github/workflows/test-copilot-network-isolation.md) uses `sandbox.agent.sudo: false` and fails to compile in the nightly E2E matrix — run [#28217234003](https://github.com/githubnext/gh-aw-test/actions/runs/28217234003).

## Expected

`gh aw compile` should accept `sandbox.agent.sudo: false` and emit the correct `--network-isolation` AWF flag in the generated lock file.

## Fix

Add `sudo` (boolean, optional) to the `sandbox.agent` properties in `pkg/parser/schema_compiler.go` (and any other schema definition that controls property validation for `sandbox.agent`).