feat: make sandbox Dockerfile mirrors optional with ARG (#14553)

### What problem does this PR solve?

Resolves #14447. *(Note: This supersedes stalled PR #14448 and
implements the requested CodeRabbitAI fixes).*

Currently, the Dockerfiles inside `agent/sandbox/sandbox_base_image`
(both Python and Node.js) have hardcoded Chinese package mirrors. This
forces the mirrors on all users globally, which causes build network
timeouts for contributors outside of China.

This PR introduces an enhancement to fix the issue by:
1. Implementing the `NEED_MIRROR` build argument in the sandbox
Dockerfiles.
2. Replacing static `ENV` instructions with conditional shell logic
inside `RUN` blocks to dynamically set the package registries.
3. Allowing the build to cleanly fall back to default global registries
(`pypi.org` and `npmjs.org`) when `--build-arg NEED_MIRROR=0` is passed.

### Type of change

- [x] New Feature (non-breaking change which adds functionality)
- [x] Refactoring

---------

Co-authored-by: Jin Hai <haijin.chn@gmail.com>

agent/sandbox/executor_manager/Dockerfile

@@ -1,6 +1,10 @@
 FROM python:3.11-slim-bookworm
 
-RUN grep -rl 'deb.debian.org' /etc/apt/ | xargs sed -i 's|http[s]*://deb.debian.org|https://mirrors.tuna.tsinghua.edu.cn|g' && \
+ARG NEED_MIRROR=1
+
+RUN if [ "$NEED_MIRROR" = 1 ]; then \
+        grep -rl 'deb.debian.org' /etc/apt/ | xargs sed -i 's|http[s]*://deb.debian.org|https://mirrors.tuna.tsinghua.edu.cn|g'; \
+    fi; \
     apt-get update && \
     apt-get install -y curl gcc && \
     rm -rf /var/lib/apt/lists/*
@@ -27,11 +31,11 @@ RUN set -eux; \
     ln -sf /usr/local/bin/docker /usr/bin/docker
 
 COPY --from=ghcr.io/astral-sh/uv:0.7.5 /uv /uvx /bin/
-ENV UV_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
 
 WORKDIR /app
 COPY . .
 
-RUN uv pip install --system -r requirements.txt
+RUN if [ "$NEED_MIRROR" = 1 ]; then export UV_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple"; else export UV_INDEX_URL="https://pypi.org/simple"; fi && \
+    uv pip install --system -r requirements.txt
 
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "9385"]

agent/sandbox/sandbox_base_image/nodejs/Dockerfile

@@ -1,6 +1,12 @@
 FROM node:24.13-bookworm-slim
 
-RUN npm config set registry https://registry.npmmirror.com
+ARG NEED_MIRROR=1
+
+RUN if [ "$NEED_MIRROR" = 1 ]; then \
+        npm config set registry https://registry.npmmirror.com; \
+    else \
+        npm config set registry https://registry.npmjs.org; \
+    fi
 
 # RUN grep -rl 'deb.debian.org' /etc/apt/ | xargs sed -i 's|http[s]*://deb.debian.org|https://mirrors.ustc.edu.cn|g' && \
 #     apt-get update && \

agent/sandbox/sandbox_base_image/python/Dockerfile

@@ -1,7 +1,8 @@
 FROM python:3.11-slim-bookworm
 
+ARG NEED_MIRROR=1
+
 COPY --from=ghcr.io/astral-sh/uv:0.7.5 /uv /uvx /bin/
-ENV UV_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
 ENV MPLBACKEND=Agg
 ENV MPLCONFIGDIR=/tmp/matplotlib
 ENV MATPLOTLIBRC=/usr/local/etc/matplotlibrc
@@ -9,12 +10,18 @@ ENV MATPLOTLIBRC=/usr/local/etc/matplotlibrc
 COPY requirements.txt .
 COPY matplotlibrc /usr/local/etc/matplotlibrc
 
-RUN grep -rl 'deb.debian.org' /etc/apt/ | xargs sed -i 's|http[s]*://deb.debian.org|https://mirrors.tuna.tsinghua.edu.cn|g' && \
+RUN if [ "$NEED_MIRROR" = 1 ]; then \
+        grep -rl 'deb.debian.org' /etc/apt/ | xargs sed -i 's|http[s]*://deb.debian.org|https://mirrors.tuna.tsinghua.edu.cn|g'; \
+        export UV_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple"; \
+    else \
+        export UV_INDEX_URL="https://pypi.org/simple"; \
+    fi; \
     apt-get update && \
-    apt-get install -y curl gcc && \
+    apt-get install -y --no-install-recommends curl gcc && \
     mkdir -p /tmp/matplotlib && \
-    uv pip install --system -r requirements.txt
+    uv pip install --system -r requirements.txt && \
+    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /workspace
 
-CMD ["sleep", "infinity"]
+CMD ["sleep", "infinity"]