fix(sandbox): add { once: true } to Docker abort signal listener

Align the Docker sandbox abort listener with the rest of the codebase
(15+ other abort listeners all use { once: true }). Without this, the
listener can accumulate in long-running sessions with many tool calls,
causing memory pressure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/agents/sandbox/docker.ts

@@ -91,7 +91,7 @@ export function execDockerRaw(
       if (signal.aborted) {
         handleAbort();
       } else {
-        signal.addEventListener("abort", handleAbort);
+        signal.addEventListener("abort", handleAbort, { once: true });
       }
     }