- Add /opt to nsjail bindmounts so Rust toolchain (/opt/rust) is accessible
during sandboxed validation of Rust bots
- Explicitly enable Alpine community repository in Dockerfile to ensure
nsjail package can be installed (nsjail lives in community, not main)
- nsjail integration was already optional (falls back to plain exec if
unavailable), but these changes ensure it actually works when enabled
This addresses bead bf-3f29: nsjail was listed in apk add but /opt wasn't
bindmounted, causing Rust validation to fail when UseNsjail=true.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>