[BUG] Resuming API-spec scans drops the specification sandbox mount

Describe the bug

Resuming a scan whose targets include an OpenAPI/Swagger specification or a Postman collection drops the specification directory from the sandbox inputs. The saved targets and agent task still refer to /workspace/api-specs/<file>, but the resumed sandbox no longer receives that mount/copy.

This affects the existing API-spec workflow introduced by #866. I found no existing issue or PR covering its resume path in the current open/closed history.

To Reproduce

1. Start a scan with strix -n -t ./openapi.json (or a supported collection file).
2. Stop after an agent snapshot has been written.
3. Resume with strix -n --resume <run-name>.
4. The reconstructed local_sources omits api-specs, although targets_info[*].details.workspace_path still points there.

I also reproduced this without Docker, an LLM, or a target service using the real argument parser and preparation functions:

sys.argv = ["strix", "-n", "-t", str(spec_file)]
original = parse_arguments()
prepare_run(original)
# Write a synthetic .state/agents.json to satisfy the resume prerequisite.
sys.argv = ["strix", "-n", "--resume", original.run_name]
resumed = parse_arguments()
prepare_run(resumed)
assert resumed.local_sources == original.local_sources

The assertion fails: the fresh run has the api-specs source, while resume returns []. A second regression confirms that a missing staged specification currently passes resume validation silently.

Expected behavior

Restore the existing per-run staged specifications to both bind-mount and copy-based sandbox inputs. Preserve the scan's staged copy rather than silently replacing it with a subsequently edited original or refetching a Postman collection. If that staged copy is gone, fail before launching with an actionable resume error, as for a missing cloned repository.

System Information:

• OS: macOS (local, isolated temporary directories)
• Strix commit: 6b7ae2ebe4d47037a927aade23265ff4e4f27e84
• Python: 3.12.14; frozen project dependencies
• LLM: none; no live scan or cloud request performed

Additional context

prepare_run() adds stage_api_specs(...) only for fresh runs. load_resume_state() rebuilds sources through collect_local_sources(), which handles local code and repositories only. A focused fix can restore the staged API-spec source during resume without changing scope extraction or fresh-scan behavior.