fix: bake version into binary at build time

Instead of hacking around the version in the Node.js wrapper script,
properly pass the version at build time via SANDBOX_AGENT_VERSION env var.

Changes:
- build.rs: Generate version.rs with VERSION constant from env var
- main.rs: Use generated version constant for clap --version
- Dockerfiles: Accept SANDBOX_AGENT_VERSION as build arg
- build.sh: Pass version as second argument to Docker builds
- release.yaml: Pass version to build script during CI
- Remove version hack from sdks/cli/bin/sandbox-agent wrapper

The version is now baked into the binary during the release build,
ensuring --version reports the correct npm package version.

docker/release/build.sh

@@ -2,6 +2,14 @@
 set -euo pipefail
 
 TARGET=${1:-x86_64-unknown-linux-musl}
+VERSION=${2:-}
+
+# Build arguments for Docker
+BUILD_ARGS=""
+if [ -n "$VERSION" ]; then
+  BUILD_ARGS="--build-arg SANDBOX_AGENT_VERSION=$VERSION"
+  echo "Building with version: $VERSION"
+fi
 
 case $TARGET in
   x86_64-unknown-linux-musl)
@@ -36,9 +44,9 @@ case $TARGET in
 
 DOCKER_BUILDKIT=1
 if [ -n "$TARGET_STAGE" ]; then
-  docker build --target "$TARGET_STAGE" -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
+  docker build --target "$TARGET_STAGE" $BUILD_ARGS -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
 else
-  docker build -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
+  docker build $BUILD_ARGS -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
 fi
 
 CONTAINER_ID=$(docker create "sandbox-agent-builder-$TARGET")

docker/release/linux-x86_64.Dockerfile

@@ -66,6 +66,10 @@ WORKDIR /build
 # Build for x86_64
 FROM base AS x86_64-builder
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Set up OpenSSL for x86_64 musl target
 ENV SSL_VER=1.1.1w
 RUN wget https://www.openssl.org/source/openssl-$SSL_VER.tar.gz \

docker/release/macos-aarch64.Dockerfile

@@ -70,6 +70,10 @@ WORKDIR /build
 # Build for ARM64 macOS
 FROM base AS aarch64-builder
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Install macOS ARM64 target
 RUN rustup target add aarch64-apple-darwin
 

docker/release/macos-x86_64.Dockerfile

@@ -70,6 +70,10 @@ WORKDIR /build
 # Build for x86_64 macOS
 FROM base AS x86_64-builder
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Install macOS x86_64 target
 RUN rustup target add x86_64-apple-darwin
 

docker/release/windows.Dockerfile

@@ -26,6 +26,10 @@ RUN cd frontend/packages/inspector && pnpm exec vite build
 
 FROM rust:1.88.0
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Install dependencies
 RUN apt-get update && apt-get install -y \
     llvm-14-dev \