docker: add DEBIAN_FRONTEND and --no-install-recommends to apt-get upgrade

Prevents debconf hangs during Docker builds and avoids pulling in
recommended packages that silently grow the image.

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile.sandbox

@@ -7,15 +7,15 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN --mount=type=cache,id=openclaw-sandbox-bookworm-apt-cache,target=/var/cache/apt,sharing=locked \
   --mount=type=cache,id=openclaw-sandbox-bookworm-apt-lists,target=/var/lib/apt,sharing=locked \
   apt-get update \
-  && apt-get upgrade -y \
+  && apt-get upgrade -y --no-install-recommends \
   && apt-get install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    curl \
-    git \
-    jq \
-    python3 \
-    ripgrep
+  bash \
+  ca-certificates \
+  curl \
+  git \
+  jq \
+  python3 \
+  ripgrep
 
 RUN useradd --create-home --shell /bin/bash sandbox
 USER sandbox