feat(sbx): VirtualBox detect-first install + local GUI VM launch

Integrate VirtualBox as a local facility rather than a shared-PTY backend: a
Windows guest has no shell to relay, so the honest fit is launching the VM's
GUI on the caller's own machine (the "share a VM, run it locally" path) — no
display is relayed to the room, so zero-knowledge is untouched.

- ensure-vbox.sh: detect-first installer mirroring ensure-docker.sh; --check,
  --plan (real apt --simulate download plan, no changes), --yes; apt/dnf/
  pacman/brew/winget; Secure Boot MOK warning. HH_VBOX_FORCE_MISSING lets a
  demo exercise the missing->install path without uninstalling.
- sbx.rs: vbox_installed/vbox_version/list_vms/vm_running/gui_launch +
  ensure_vbox_install.
- app.rs: /sbx vms (detect + list) and /sbx gui <vm> [--install] (detect-first
  then startvm --type gui); /sbx launch virtualbox steers to /sbx gui.
- ui.rs help: /sbx vms and /sbx gui entries.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hh/src/ui.rs

@@ -154,6 +154,8 @@ fn help_clusters(theme: &Theme) -> Vec<HelpCluster> {
                 kv("/sbx save [label]", "snapshot state (docker image; survives stop)"),
                 kv("/sbx load <label>", "launch a fresh sandbox from a saved snapshot"),
                 kv("/sbx snaps", "list saved snapshots"),
+                kv("/sbx vms", "list local VirtualBox VMs"),
+                kv("/sbx gui <vm>", "boot a VirtualBox VM locally in its GUI"),
                 kv("/drive  ·  F2", "type into the shared shell  (Esc releases)"),
             ],
         },