Summary

Unauthenticated pulls from Docker Hub hit 429 rate limits in E2E tests. This switches the three test files that use python:* base images to alternatives that don't pull from Docker Hub.

Changes

• custom_image.rs: python:3.13-slim → public.ecr.aws/docker/library/python:3.13-slim (ECR public mirror, keeps a truly custom Dockerfile with iproute2 + sandbox user)
• forward_proxy_l7_bypass.rs: python:3.13-alpine → ghcr.io/nvidia/openshell-community/sandboxes/base:latest (community sandbox base)
• host_gateway_alias.rs: python:3.13-alpine → ghcr.io/nvidia/openshell-community/sandboxes/base:latest (community sandbox base)

Testing

• mise run pre-commit passes
• E2E tests pass (pending CI run)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)