A user-supplied env var that collides with a controller-set one makes the Sandbox invalid

`buildEnvVars` appends `run.Spec.Env` after the controller's own, and the
Sandbox CRD rejects duplicate env names, so an AgentRun that sets one the
controller already sets never starts:

```
Sandbox.agents.x-k8s.io "e2e-live" is invalid:
spec.podTemplate.spec.containers[0].env[9]: Duplicate value: {"name":"KONVEYOR_ACP_SECRET_KEY"}
```

The run sits at `Pending`/`SandboxCreationFailed` with that buried in a
condition. `agentrun_controller.go` says "user-specified sources last: for
duplicate keys, later entries win", which is not true for this CRD.

Predates #157: both the append and `KONVEYOR_ACP_SECRET_KEY` are on main. Found
while driving a run by hand.

Either dedupe by name with the user's value winning, as the comment already
claims, or reject the collision at reconcile with a message naming the variable.

Start in agentrun_controller.go at buildEnvVars and compare its user-specified-source ordering with the Sandbox CRD's duplicate-name validation. Decide whether collisions should be deduplicated with the user's value or rejected during reconcile, then verify that a colliding variable no longer leaves the AgentRun pending without a clear outcome.

Written by the indexing model from the issue text.