refactor(eval): Directly fetch sandbox image

The sandbox pre-fetch logic no longer relies on the side effect of
running a `gemini --sandbox no-op` command.

The script now determines the required image version via
`gemini --version` and fetches it directly with `docker pull`. This
approach is more efficient and explicit.

Bug: 449204868
Change-Id: I0ed88a76a5c14084d0039204315fba35038d32a2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7008411
Auto-Submit: James Woo <jewoo@google.com>
Commit-Queue: Struan Shrimpton <sshrimp@google.com>
Reviewed-by: Struan Shrimpton <sshrimp@google.com>
Reviewed-by: Brian Sheedy <bsheedy@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1525861}