Delegate make remote-build to sandboxer create when CLI is available; retain legacy rsync path with deprecation notice. Add verify script.
