feat: remote-build shim via sand-boxer (SAND-WP-0012)

Delegate make remote-build to sandboxer create when CLI is available;
retain legacy rsync path with deprecation notice. Add verify script.

scripts/verify-remote-build-shim.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Verify remote-build shim prerequisites (SAND-WP-0012-T04).
+set -euo pipefail
+
+ERR=0
+
+check_cmd() {
+  if command -v "$1" >/dev/null 2>&1; then
+    echo "OK  $1 → $(command -v "$1")"
+  else
+    echo "FAIL $1 not on PATH" >&2
+    ERR=1
+  fi
+}
+
+echo "==> CLI prerequisites"
+check_cmd sandboxer
+
+echo "==> Build-machines Makefile shim"
+MAKEFILE="${HOME}/the-custodian/infra/build-machines/Makefile"
+if grep -q 'remote-build-sandboxer' "$MAKEFILE" 2>/dev/null; then
+  echo "OK  remote-build-sandboxer target present"
+else
+  echo "FAIL remote-build-sandboxer not in $MAKEFILE" >&2
+  ERR=1
+fi
+
+echo "==> VM tunnel (optional for live run)"
+if [[ -n "${SANDBOXER_VM_TUNNEL_PORT:-}" ]]; then
+  echo "OK  SANDBOXER_VM_TUNNEL_PORT=${SANDBOXER_VM_TUNNEL_PORT}"
+else
+  echo "WARN SANDBOXER_VM_TUNNEL_PORT unset (set before live remote-build)" >&2
+fi
+
+VM="${VERIFY_VM:-haskell-build}"
+if ssh -q -o ConnectTimeout=2 "$VM" "echo ok" 2>/dev/null; then
+  echo "OK  ssh $VM reachable"
+else
+  echo "WARN ssh $VM not reachable (expected when tunnel down)" >&2
+fi
+
+echo "==> Optional live run (VERIFY_REMOTE_BUILD_RUN=1)"
+if [[ "${VERIFY_REMOTE_BUILD_RUN:-}" == "1" ]]; then
+  PROJECT="${VERIFY_PROJECT:-${HOME}/sand-boxer}"
+  cd "${HOME}/the-custodian/infra/build-machines"
+  make remote-build "PROJECT=${PROJECT}" "VM=${VM}"
+  echo "OK  make remote-build PROJECT=${PROJECT}"
+fi
+
+if [[ "$ERR" -ne 0 ]]; then
+  exit 1
+fi
+echo "==> PASS prerequisites"