## Summary
- add missing task sandbox fields to the mise task schemas
- add top-level `env_file`/`dotenv`/`env_path` schema entries and mark
them deprecated as legacy shortcuts
- allow env age directive options, tighten complex age option nesting,
and cover the schema fixture
- keep sandbox fields in a task-only schema overlay so they validate for
`[tasks.*]` but do not leak into `[task_templates.*]`, whose Rust type
does not deserialize/apply them

## Context
- The renderer builds both task and `task_template` schemas from
`task_props`. The new `taskOnlyProps` overlay is for fields accepted by
`Task` but not `TaskTemplate`; this mirrors the existing task-only
treatment for `extends`.
- `env_file`, `dotenv`, and `env_path` are still accepted by current
serde parsing, but they are legacy top-level shortcuts.
#1361 marked `env_file`/`env_path`
deprecated in favor of `env.mise.file`/`env.mise.path`;
#1519 later rewrote env parsing and kept
accepting `env_file`, alias `dotenv`, and `env_path` without a runtime
deprecation warning. The schema keeps them valid but marks them
deprecated to point users at `[env] _.file` / `_.path`.
- Task sandbox config fields were introduced with process sandboxing in
#8845; `allow_env` wildcard semantics
were later expanded in #8974.
- Age env directives, including flattened `EnvDirectiveOptions` on age
values, were introduced in #6463. This
PR now mirrors the Rust variants more closely: top-level age options are
allowed with `age = "..."`, while complex `age = { value = ... }`
options must be nested inside the `age` object.

## Verification
- `bun xtasks/render/schema.ts`
- `jq empty schema/mise.json schema/mise-task.json schema/miserc.json`
- `git diff --check`
- `mise run test:e2e e2e/config/test_schema_tombi`