fix(swarm-test): give the sandbox tier a second node in the lab

Dedicating a single worker to the sandbox left the drain step with nowhere to
put the agent: draining the only labelled node failed with `no suitable node
(scheduling ...)`. Two labelled workers are also what the requirement asks for,
so the earlier single-worker choice traded one defect for another.

The cost is deliberate: the inverse placement constraint pushes every
non-sandbox service off both workers, so the stack host carries the rest of the
platform. That is the topology the requirement describes, and whether the stack
host holds up under it is what the next swarm run measures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

utils/tests/swarm/extend_inventory.py

@@ -86,7 +86,7 @@ def main() -> int:
     closure = derive_includes(app_id)
     group_hosts = _host_topology(app_id) + _placement_dep_groups(app_id)
     if "svc-virt-kata" in closure:
-        group_hosts.extend(("svc-virt-kata", host) for host in (_MANAGER, _WORKERS[-1]))
+        group_hosts.extend(("svc-virt-kata", host) for host in (_MANAGER, *_WORKERS))
     group_hosts.extend(
         repo_placements(
             app_closure=closure,