Router should use longest valid pathPrefix match for sandbox entrypoints

The router currently picks the first entrypoint where strings.HasPrefix(path, ep.Path) is true.

That breaks overlapping prefixes. If a runtime has both / and /api, then /api/foo can get routed to / depending on the order in the CR. Also /api2 matches /api, which is not really the documented /api/... behavior.

Steps:

1. Create an AgentRuntime/CodeInterpreter with two ports:
   • /
   • /api
2. Put / before /api in the spec.
3. Send a request to /api/foo.

Expected:
Request goes to the /api entrypoint.

Actual:
Request can go to the / entrypoint.

This should probably do longest-prefix matching and make sure /api only matches /api or /api/..., not /api2.