test(sandbox): improve AllowedHosts test coverage

[decko]

Context

PR #679 added tests for collectAllowedHosts and effectiveUseNetNS, but coverage has gaps.

Issues

1. collectAllowedHosts tests only check result count, not content — a bug corrupting Host/Port values would pass
2. No YAML round-trip test verifying allowed_hosts parses correctly from config
3. No tests for convertAllowedHosts converters in cmd/soda/run.go and internal/pipeline/engine.go
4. Map iteration order in collectAllowedHosts is nondeterministic — consider sorting by server name

Fix

• Add content assertions for dedup and single-server cases
• Add config test with allowed_hosts in YAML testdata
• Add compile-time field coverage check for converters

Found by

Go Specialist review of PR #679.