Fix Docker CI build failures across all three images

[Copilot]

The Docker CI workflow was failing during image builds due to three independent bugs in the Dockerfiles.

Dockerfile.base — cspkg/ecs binaries not found

• covscript.7z extracts its contents under a build/ subfolder, not at the archive root
• The extraction step assumed a flat layout, so cspkg and ecs never landed at /opt/covscript/bin, causing cspkg: not found (exit 127)
• Now extracts to a temp directory first, then relocates build/* into /opt/covscript

Dockerfile.web — invalid ARG scoping across build stages

• ARG BASE_IMAGE was declared inside the second stage, after the first FROM
• Docker requires ARGs referenced in a FROM to be declared before any stage, otherwise the value resolves empty:

# before (broken)
FROM node:20-alpine AS frontend
...
ARG BASE_IMAGE=covscript-base:latest
FROM ${BASE_IMAGE}   # ERROR: base name should not be blank

# after
ARG BASE_IMAGE=covscript-base:latest
FROM node:20-alpine AS frontend
...
FROM ${BASE_IMAGE}

Dockerfile.sandbox — permission denied removing compiled source

• Only /app/data was chowned to the sandbox user, leaving /app itself owned by root
• The non-root sandbox user could write server.ecs into /app (via COPY --chown) but couldn't delete it afterward, since directory write permission (not file ownership) governs deletion
• Now chowns the whole /app directory to sandbox