feat(sandbox): add Freestyle VM provider

[theswerd]

Adds freestyle as a built-in sandbox backend so environments and agents can run in Docker-capable Freestyle VMs. The existing VM helpers supply image/artifact deployment and container file handling; the adapter supplies root command execution, binary host-file writes, HTTPS ports, resource growth, reconnection, attribution metadata, and teardown. It uses the existing httpx dependency.

VM creation declares its firewall and HTTPS routes together, sets an absolute TTL, and cleans up setup failures and cancellation. Configuration resolves credentials through the existing config/secret-store mechanism; credentials are never injected into the guest.

This first adapter supports allow_all egress. Restricted policies fail before provisioning so fallback chains can select another backend. Commands use the buffered exec API with a maximum five-minute runtime; longer services run in Docker or in the guest background. Snapshot resource minimums are retained because Freestyle only resizes upwards. The provider guide documents these limits and configuration.

Validation:

• Full unit/protocol suite: 7,040 passed, 16 capability skips (Python 3.13).
• Real Freestyle smoke: container deployment, HTTPS, container text-file writes, 1 MiB binary checksum, reconnect, Docker Compose, deletion/404 and repeated teardown. Passed on the default Ubuntu snapshot and on freestyle/ubuntu-sm, where CPU, memory and storage growth were exercised and verified (3 vCPUs, 5,120 MiB memory, 17 GiB disk). All test VMs were deleted.
• Clean install: both wheels built and installed fresh from public PyPI dependencies; two hello runs passed with no remaining sandbox work folders (Python 3.11).
• Plugin API compatibility check, Ruff checks for the new adapter/tests, and git diff --check passed.
• The smoke test uses the existing remote_sandbox capability gate and skips without configured credentials.

Local Docker integration and installer tiers were not run: the local Docker daemon is unavailable. Opening as a draft for maintainer discussion of the provider contract and limits before review/merge.

Upstream CI is awaiting maintainer approval for this fork: the three GitHub workflows report action_required, and CodeBuild reports that the build was not triggered because pull request approval is required. Socket Security checks passed.