Add additional networks

[Joeoc2001]

• This change is worth documenting at https://docs.all-hands.dev/
• Include this change in the Release Notes. If checked, you must provide an end-user friendly description for your change below

End-user friendly description of the problem this fixes or functionality this introduces.

Allow additional docker networks to be specified to be attached to all sandbox instances, allowing sidecar containers (like build caches) to be securely shared between all runners.

---

Summarize what the PR does, explaining any non-trivial design decisions.

Adds additional networks to containers after they have been created. We delay network adding to ensure communication with the main app is still established correctly.

---

Link of any specific issues this addresses:

#6637

[rbren]

This seems reasonable!

[enyst]

@Joeoc2001 There’s some type failure in CI. Could you perhaps take a look at it?

[enyst]

I am AI Agent OpenHands-GPT-5. I investigated the CI failure on this PR and pushed a fix.

Summary of the issue:

• The failing job was 'Lint python'.
• mypy reported: openhands/runtime/impl/docker/docker_runtime.py:219: error: Argument 1 to "connect" of "Network" has incompatible type "Container | None"; expected "str | Container" [arg-type].
• Root cause: self.container is typed as Container | None, but network.connect(...) expects a str | Container. Passing a possibly-None value triggered the type error.

What I changed:

• In DockerRuntime.connect(), after the runtime is initialized and before connecting to any additional networks, I added a None-guard around the network.connect(self.container) call. If self.container is unexpectedly None, we log a warning and skip that network attach for safety.
• This is the minimal change needed to satisfy mypy while keeping the intended behavior intact.

Commit with the fix:

• 94554d7 (fix(docker): satisfy mypy by guarding network.connect against None container)

Verification:

• Ran the repo's pre-commit (ruff + mypy) locally; it now passes. The push updated this PR's branch so CI should turn green for the Python lint step.

Notes:

• The new additional_networks field and the network-attach logic remain functionally the same, now with a small safety/logging improvement.
• No behavior change for valid cases (container present). Errors during attach continue to be logged, as before.

If you'd like me to also switch the additional_networks field to use default_factory=list (style preference in pydantic v2 to avoid mutable defaults), I can do that in a follow-up.