feat: remote-build shim via sand-boxer (SAND-WP-0012)

Delegate make remote-build to sandboxer create when CLI is available;
retain legacy rsync path with deprecation notice. Add verify script.

infra/build-machines/README.md

@@ -75,7 +75,7 @@ ssh haskell-build          # should connect via tunnel
 ## Using the VM
 
 ```bash
-# Build a Haskell project remotely
+# Build a Haskell project remotely (prefers sand-boxer workspace when installed)
 make remote-build PROJECT=~/projects/my-app
 
 # Run tests