Announce sandbox image pulls: source + duration

A multi-GB docker pull ran with fully captured output -- minutes of
silence that read as a hang (user interrupted a healthy run over it).
Each mirror attempt now prints which source it is trying and how long
a hit took.

Co-Authored-By: Claude <noreply@anthropic.com>

evalharness/sandbox/prefetch.py

@@ -93,13 +93,27 @@ def prefetch_images(images: Iterable[str], workers: int = 8) -> List[str]:
     return pulled
 
 
-def _pull_one(image: str) -> None:
+def _pull_one(image: str, verbose: bool = True) -> None:
-    """Pull via CN-mirror fallback chain; retag to the canonical name on hit."""
+    """Pull via CN-mirror fallback chain; retag to the canonical name on hit.
+
+    A multi-GB pull runs silently for many minutes with capture_output --
+    which reads as a hang -- so say WHICH source is being tried and how
+    long it took."""
+    import sys as _sys
+    import time as _time
     last_err = None
     for template in _CN_MIRROR_FALLBACKS:
         ref = template.format(img=image)
+        if verbose:
+            src = 'docker.io(daemon mirrors)' if '{img}' in template else template.split('/{img}')[0]
+            print(f'· pulling sandbox image {image} via {src} ...',
+                  file=_sys.stderr, flush=True)
+        t0 = _time.monotonic()
         r = subprocess.run(['docker', 'pull', ref], capture_output=True, text=True,
                            timeout=3600)
+        if r.returncode == 0 and verbose:
+            print(f'✓ image ready in {_time.monotonic() - t0:.0f}s',
+                  file=_sys.stderr, flush=True)
         if r.returncode == 0:
             if ref != image:  # retag the mirrored pull to the canonical name
                 subprocess.run(['docker', 'tag', ref, image], check=False)