fix(sandbox): preinstall chart dependencies and CJK fonts

[dadachann]

Summary

• Preinstall pinned Matplotlib/pandas and Debian Noto CJK fonts.
• Set installation-wide headless/CJK defaults while preserving the complete upstream Matplotlib defaults template.
• Gate builds on real Chinese PNG rendering and pandas smoke tests; add non-publishing multi-architecture PR CI.
• Rebuild on dependency/config/test changes and document updating existing sandboxes.

Verification

• Old image fails imports; libraries alone still fail default Chinese glyph coverage.
• Local image build and fresh offline root + non-root/read-only containers pass both smoke tests.
• Generated PNG visually verified for simplified/traditional Chinese and negative ticks.
• amd64 + arm64 CI passed: https://github.com/langbot-app/dockerfiles/actions/runs/34045416642

Fixes langbot-app/LangBot#2332