feat: add sandbox provider conformance

[yanpgwang]

Summary

• add a lazy, immutable sandbox provider registry with strict deployment-level selection
• add a reusable lifecycle conformance suite for local, Docker, and future remote adapters
• fail closed on unknown MANAGED_AGENT_SANDBOX values instead of silently executing on the host
• enforce local workspace ownership during Attach while preserving existing durable reference values
• keep provider selection and mechanics out of the Claude Managed Agents public API

Provider contract

The shared suite covers stable identity, POSIX execution, binary file round trips, path confinement, cancellation, idempotent Create, fresh-client Attach, workspace preservation, cross-session ownership rejection, idempotent Destroy, and explicit ErrNotFound after deletion. Provider-specific isolation/resource tests remain separate.

Scope

This is the adapter foundation, not a sandbox service and not a provider-specific public API. E2B, CubeSandbox, OpenSandbox, and other remote adapters remain follow-up PRs. Docker still uses its existing CLI transport; orphan reconciliation and optional pause/snapshot capabilities are separate work.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• real local and Docker provider conformance against Docker Engine
• real PostgreSQL + Temporal local/Docker tool vertical slices
• Claude Sonnet review: no P0/P1 findings; MERGEABLE yes

golangci-lint was unavailable locally and is left to CI.