Allow Sandbox container limits overrides

Makefile

@@ -35,12 +35,19 @@ STATE_DIR    := $(HOME)/.local/state/opencode
 # it fails fast rather than thrashing. Sized to leave ~1 GiB / 2 CPUs of
 # headroom below the VM's own allocation for the VM/podman/gvproxy itself --
 # adjust alongside `podman machine set` if you resize the machine again.
+# Override any of these per-invocation by exporting OPENCODE_SANDBOX_MEMORY,
+# OPENCODE_SANDBOX_MEMORY_SWAP, and/or OPENCODE_SANDBOX_CPUS before running
+# `make opencode`/`make shell`.
+OPENCODE_SANDBOX_MEMORY      ?= 3072m
+OPENCODE_SANDBOX_MEMORY_SWAP ?= 3072m
+OPENCODE_SANDBOX_CPUS        ?= 4
+
 RUN_FLAGS := \
 	--rm -it \
 	--userns=keep-id \
-	--memory=3072m \
-	--memory-swap=3072m \
-	--cpus=4 \
+	--memory=$(OPENCODE_SANDBOX_MEMORY) \
+	--memory-swap=$(OPENCODE_SANDBOX_MEMORY_SWAP) \
+	--cpus=$(OPENCODE_SANDBOX_CPUS) \
 	--network $(NETWORK_NAME) \
 	--network-alias $(WORKDIR_NAME) \
 	-v $(CURDIR):/workspace \