Fix make build: invoke prepare-sandbox-build-context.py via venv

[jwbron]

Summary

make build was failing in the integration-tests CI job with:

==> Preparing sandbox build context from repositories.yaml...
Error: PyYAML is required. Install with: pip install pyyaml
make: *** [Makefile:463: build] Error 1

Observed on PR #2642 (run 25752177721).

Root cause

scripts/prepare-sandbox-build-context.py has a #!/usr/bin/env python3 shebang. The build recipe invoked it directly:

@scripts/prepare-sandbox-build-context.py repo-deps

That resolves to system python3, which has no PyYAML — so _load_repos_config() aborts before any docker build runs. The .github/workflows/test-integration.yml job does uv sync --extra dev first, which populates .venv/ with the project's pinned PyYAML, but make build bypassed it.

This is the same pattern other targets (test, lint, security) avoid by routing through $(PYTHON) (Makefile:21), which resolves to .venv/bin/python when the venv exists and falls back to python3 otherwise.

Fix

• Route the script through $(PYTHON) so the venv's interpreter (and pinned PyYAML) is used.
• Gate build on sync-venv-if-uv so a fresh worktree provisions .venv before the script runs — same prereq pattern as test/lint/security.

Test plan

• CI on this PR runs make build in the integration-tests job — it must reach the docker build steps (the failure mode was the script aborting before any image build).
• Manual: re-run failing job on Fix #2626: orchestrator pre-sync commit no longer deletes agent-pushed files #2642 once this lands (or rebase Fix #2626: orchestrator pre-sync commit no longer deletes agent-pushed files #2642 on top of this).

[james-in-a-box]

egg review completed. View run logs