logging: migrate both binaries to projecteru2/core/log

[CMGS]

Both binaries move from logr + klog to github.com/projecteru2/core/log, the logger the rest of the cocoon family uses. Rebased onto master after #42 merged.

What changes

• pkg/logbridge (new): a logr.LogSink that writes through core/log, the same shape as cocoon-operator's logbridge.go. logbridge.New(ctx) returns a logr.Logger; Enabled keeps level 0 only (V(1+) is dropped, which is today's verbosity 0), Error(nil, …) (what logr and klog.Errorf/Errorln pass for an error with no value) stays at error level with the message as the error, since core/log drops a nil err, key/value pairs render as k=v. vk-sandbox consumes this package too.
• sandbox-apiserver: log.SetupLog from OPERATOR_LOG_LEVEL (default info, zerolog level names; an unknown level exits 1 with setup log:), then ctrl.SetLogger(logbridge.New(ctx)) and klog.SetLogger(logbridge.New(ctx).WithName("klog")), so the generic apiserver's klog output joins the same stream.
• sandbox-envd-proxy: the same setup, ctrl.SetLogger and klog.SetLogger (client-go's flowcontrol and reflector lines join the stream too); klog.ErrorS + os.Exit(1) becomes Fatalf.
• Packages log through log.WithFunc("pkg.Func") at the log site, so the claim, list and proxy request paths build no logger on success. Level mapping: logr Info → Info, V(1).Info → Debug, Error(err, …) → Error with the error structural. One level change: the warm-pool driver's no-token skip moves from Info to Warn (logr has no warn level; a fail-closed skip is degradation).
• e2bcompat's writeVerbError / writeLookupError take the request instead of the id (which they read from the sandboxID path value, as every caller did), so the error log carries the request context.
• Exported surface removed: scale.WithLogger, warmpool.Options.Log, e2bcompat.Options.Log, envdproxy.Options.Log. Callers and tests drop the logr.Discard() argument; no test asserted on a log line, so none is deleted.
• deps: github.com/projecteru2/core v0.1.5 (the family's current pin; the one-version rule is tracked in Org upkeep: lint baseline (revive, nolintlint) and tool/toolchain pin refresh across the family .github#1 §6). go-logr/logr stays (the bridge implements its sink), klog/v2 stays (klog.SetLogger).
• docs: configuration.md documents the core/log stream and OPERATOR_LOG_LEVEL.

LOC

Prod +163 / −94 (net +69): the bridge is 60 of those lines and is the family's controller-runtime pattern shared with vk-sandbox; the rest is log.WithFunc(…) and the level/setup blocks replacing shorter logr calls. Tests +36 (the bridge test). Comment lines +3 / −4.

Gates (re-run at the PR head)

• make lint: 6 × 0 issues. (both GOOS, with and without each harness tag); make fmt-check rc=0.
• asl -forwarder=false: 0 findings on darwin and linux, with and without each harness tag.
• go test -race -count=1 ./...: 9 packages ok; go vet on both tagged harnesses ok; go mod tidy no diff; make generate / make api-docs no diff.
• Binary smoke without a cluster: OPERATOR_LOG_LEVEL=loud exits 1 with setup log: Unknown Level String: 'loud' on both binaries; with debug, both print their start line through core/log (INF starting sandbox-apiserver … func=main.run), controller-runtime's config error arrives through the bridge (func=controller-runtime.client.config), and envd-proxy's exit is the FTL … func=main line.
• pkg/logbridge test: Error with and without an err value logs at error level with its name, message and key/values; it fails on a warn downgrade. Routing also checked from a scratch program: named/valued controller-runtime lines, klog.InfoS/ErrorS under func=klog, V(1)+ dropped.
• vk-sandbox (5a60b65, scratch copy with a temporary replace) builds, vets and passes its race tests against this head.
• Not run: a Linux container pass (nothing here is Linux-gated; linux lint and asl ran via GOOS=linux).