Restore _driveAsync in sandbox host-callback

With the pending_cek snapshot fix, _driveAsync no longer causes
duplicate resume chains. Needed for event-triggered suspensions
(btn.click → handler → perform) where the suspension propagates
through addEventListener, invisible to the outer eval.

Sandbox bytecode test: 6/6 io-sleep suspensions confirmed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/playwright/sx-inspect.js

@@ -1391,10 +1391,9 @@ async function modeSandbox(page, expr, files, setup, stack, bytecode) {
       if (typeof fn === 'function' && fn.__sx_handle === undefined) return fn;
       if (fn && fn.__sx_handle !== undefined) {
         return function() {
-          // Do NOT call _driveAsync here — the suspension propagates through
-          // the normal CEK/VM return path. The outer callFn handles it.
-          // Calling _driveAsync would create a duplicate resume chain.
-          return K.callFn(fn, Array.from(arguments));
+          const r = K.callFn(fn, Array.from(arguments));
+          window._driveAsync(r);
+          return r;
         };
       }
       return function() {};