Support Smol Machines as a local and cloud VM sandbox provider #156

Use case

Run agent-env environments and agents in Smol Machines VMs on a developer laptop or Smol Cloud, using the same image artifacts and gateway workflows as the current Docker-backed VM providers.

Proposed provider

Add an optional smol sandbox provider selectable in [sandbox] with a target (local or cloud) in [sandbox.providers.smol.config]. Each sandbox gets a VM with Docker in its persistent storage; load or pull the existing Docker image, run the container, and expose its service port through a scoped loopback TCP tunnel. Smol's VM egress policy should enforce agent-env allowlists at machine creation; unsupported policy entries should fail closed. Cleanup must close tunnels and delete the VM on normal exit, errors, and cancellation. Keep the Smol SDK as an optional extra so a plain agent-env install is unaffected.

I verified in live local and Cloud VMs that Docker's overlay2 storage driver works with /storage and that published HTTP traffic passes through private SDK TCP tunnels on both targets. I will add provider contract tests plus live VM and Docker service checks before submitting the change.