fix(sbox): add deny-by-default .gitignore rules for sbox dir

PR #251 reviewer (@yuh-yang) flagged that the original sbox commit only
added Step 6 re-allow entries (!/sbox/, !/sbox/agent-harness/) but missed
the Step 5 deny-by-default lines every other harness has. As a result,
any non-harness file dropped into sbox/ (including dotfiles) was silently
trackable, breaking the deny-by-default invariant the rest of the repo
relies on.

Verified before fix:
  $ git check-ignore -v sbox/foo.txt   # no match (BUG)
  $ git check-ignore -v lldb/foo.txt   # .gitignore:171:/lldb/*

After this commit both should resolve to the matching Step 5 rule.

Inserted right after the lldb block (lines 171-172) to match the
insertion-order convention used for the other recent harness additions.

.gitignore

@@ -170,6 +170,8 @@
 /nsight-graphics/.*
 /lldb/*
 /lldb/.*
+/sbox/*
+/sbox/.*
 
 # Step 6: ...except agent-harness/
 !/gimp/agent-harness/