Add gVisor toleration to anthropic-agent-sandbox SandboxTemplate for GKE 1.35.5+ secure-sandbox-policy

[inardini]

Description

GKE 1.35.5 ships a ValidatingAdmissionPolicy (secure-sandbox-policy) that denies any Sandbox whose podTemplate does not tolerate sandbox.gke.io/runtime=gvisor:NoSchedule. Without this toleration the SandboxWarmPool silently stays at 0 ready with no events on the pool, so the example stops working on clusters at or above 1.35.5. This PR adds the toleration to the SandboxTemplate. Follow-up to #2090.

Tasks

• The contributing guide has been read and followed.
• The samples added / modified have been fully tested.
• Workflow files have been added / modified, if applicable.
• Region tags have been properly added, if new samples.
• Editable variables have been used, where applicable.
• All dependencies are set to up-to-date versions, as applicable.
• Merge this pull-request for me once it is approved.