Network-isolated build verification harness for vendor packages

[Minipada]

Parent

#421

What to build

Extend tools/e2e/Containerfile's toolchain stage / tools/e2e/scripts/build.sh with a --network none build variant covering the aws_sdk_vendor and vector_vendor layers, wired as a CI job (or a script flag). Demoable on its own: running it against current main fails with a clear, attributable network-access error — proving the seam works before it's asked to pass.

Acceptance criteria

• tools/e2e/scripts/build.sh (or a new script) supports a network-isolated build mode targeting the toolchain stage's vendor-package layers
• Running it against current main fails with a clear, attributable network-access error (not a generic timeout/crash)
• Wired into CI as a job (may be non-blocking/allowed-to-fail until vector_vendor: checked-in binary, no network fetch #424 and aws_sdk_vendor: flattened source, no network fetch #425 land)

Blocked by

• None — can start immediately.

[Minipada]

Resolved by #428 (merged into jazzy). Auto-close via "Closes #423" didn't fire because the repo's default branch is humble, not jazzy, so closing manually.