sandbox: release the token only when it was acquired

[justskiv]

Exec registers defer semaphore.Release() before checking whether
Acquire() returned ErrBusy, so a request rejected as busy puts back a
token it never took. The next caller acquires it and starts a worker beyond
pool_size.

I measured it with pool_size: 1 and a burst of 8 requests sleeping 3 seconds,
sampling docker ps alongside:

binary	admitted	busy	peak containers
v0.14.0	4	4	4
with the fix	1	7	1

The sandbox and the container runtime do not matter — the defect is in
internal/sandbox, above the engine.

Sequential requests never show it: Release is non-blocking, so at rest the
semaphore is back to pool_size. It takes a burst, where every rejection hands
out one more slot: for K requests hitting a pool with s free tokens, up to
(K + s) / 2 get in instead of s. The ceiling follows the load, not the
setting.

To see it fail without Docker, put the defer back above the ErrBusy check
and run go test ./internal/sandbox/:

sandbox_test.go:96:  want 0, got 1
sandbox_test.go:100: want error, got <nil>

The busy subtest now checks that a rejection leaves no free tokens and that
the request right after it is rejected too — the contract the doc comment on
Exec already promises. The exec subtest checks that a finished worker
returns its token.

The Exec body is unchanged since the first public commit (8447197), so
every release is affected. I did not find this in the tracker.

---

Unrelated: pool_size has no default and is not validated, so a config
without the key gives NewSemaphore(0) and a busy response to everything.