feat(tools/e2e): network-isolated build verification harness for vendor packages

[Minipada]

Summary

• Adds a vendor-network-check stage to tools/e2e/Containerfile that builds aws_sdk_vendor and vector_vendor under RUN --network=none (a per-instruction Buildah/Podman flag — verified to take precedence over build.sh's top-level --network host), while their rosdep/apt dependency install stays in a separate, normally-networked layer. toolchain is split into toolchain-base + toolchain so this new stage branches off before the production toolchain stage builds aws_sdk_vendor, making it a real from-scratch attempt rather than a cache hit against already-built work.
• Adds tools/e2e/scripts/verify_network_isolation.sh, a thin wrapper around build.sh (TARGET=vendor-network-check) that is the harness's entry point for both local dev and CI.
• Wires it into .github/workflows/ci.yaml as a new standalone network-isolation-check job, marked continue-on-error: true since it's expected to fail until vector_vendor: checked-in binary, no network fetch #424 and aws_sdk_vendor: flattened source, no network fetch #425 replace aws_sdk_vendor's git clone and vector_vendor's binary download with vendored/prebuilt sources.

Verified locally (podman build --target vendor-network-check): the isolated build fails today with a clear, attributable network error for each package — fatal: unable to access 'https://github.com/aws/aws-sdk-cpp.git/': Could not resolve host: github.com for aws_sdk_vendor, and Couldn't resolve host name for vector_vendor's file(DOWNLOAD ...) — not a generic timeout or crash, proving the isolation seam works before it's asked to pass.

Test plan

• git add -A && prek run --all-files --skip build-doc passes (hadolint, shellcheck, REUSE, clang-format, etc.)
• podman build --target vendor-network-check -f tools/e2e/Containerfile . (via verify_network_isolation.sh) fails today with clear, attributable network errors for both aws_sdk_vendor and vector_vendor
• podman build --target toolchain -f tools/e2e/Containerfile . still reaches the aws_sdk_vendor build step normally (production path unaffected by the toolchain-base/toolchain split)
• CI network-isolation-check job runs green (non-blocking) on this PR

Closes #423

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.93%. Comparing base (439b584) to head (8e6f128).
⚠️ Report is 1 commits behind head on jazzy.

Additional details and impacted files

@@           Coverage Diff           @@
##            jazzy     #428   +/-   ##
=======================================
  Coverage   70.93%   70.93%           
=======================================
  Files         119      119           
  Lines        7401     7401           
=======================================
  Hits         5249     5249           
  Misses       2152     2152           

Flag	Coverage Δ
cpp-jazzy	70.93% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.