feat(sandbox): add CoreWeave Sandbox (cwsandbox) provider

[brandonrjacobs]

Summary

Adds CoreWeave Sandbox (https://www.cwsandbox.com) as a sandbox provider,
alongside Modal and Daytona. CWSandboxLauncher wraps the official
cwsandbox Python SDK as an
optional, lazily-imported extra (omnigent[cwsandbox]) — same posture as the
existing modal/daytona launchers.

Supports both server-managed hosts (sandbox.provider: cwsandbox) and the
CLI bootstrap (omnigent sandbox create --provider cwsandbox). The only
unsupported primitive is forward_local_port (CW Sandbox has no local→sandbox
path), which is irrelevant here — managed hosts authenticate with a
server-minted launch token, not the Databricks App OAuth flow.

Changes

• omnigent/onboarding/sandboxes/cwsandbox.py — the launcher (provision / run /
  put / terminate + streaming exec/foreground).
• Register cwsandbox in the provider table and the server managed-host YAML
  config (SUPPORTED_SANDBOX_PROVIDERS, PROVIDERS_WITH_MANAGED_LAUNCH,
  factory + config parsers + token TTL).
• pyproject.toml: cwsandbox extra + mypy override.
• Unit tests (httpx-free, fake SDK via sys.modules).
• deploy/cwsandbox/: README, a zero-dependency API smoke test, and a managed
  e2e driver.

Validation

Exercised end-to-end against production api.cwsandbox.com:

• API smoke test — provision → exec → AddFile → public egress → detach →
  terminate, all pass.
• Managed-host e2e — ran the Omnigent server inside a CW sandbox (public
  ingress), created a managed session, and the server provisioned a child CW
  sandbox running omnigent host that dialed back and registered.
• Real agent workload — the agent ran an LLM turn (via the openai-agents
  harness against an OpenAI-compatible CoreWeave inference endpoint) inside the
  managed sandbox and returned a correct answer.

Unit tests + ruff + mypy all green.

Notes for reviewers

• _ensure_sdk() in __init__ is a deliberate workaround: the cwsandbox
  SDK installs signal handlers at import time, which raises when imported in a
  worker thread (the managed flow calls prepare()/provision() via
  asyncio.to_thread). Importing at construction (main thread) sidesteps it.
  Removable once Import time signal handler install crashes from non-main threads such as marimo coreweave/cwsandbox-client#136 (PR perf(e2e_ui): round-robin shard split to balance CI wall-clock omnigent-ai/omnigent#138) ships.
• The extra pins cwsandbox>=0.26,<1; uv.toml's exclude-newer may need a
  bump for CI to resolve it.

Testing

pip install -e '.[cwsandbox,dev]'
pytest tests/onboarding/sandboxes/test_cwsandbox.py
# live API check:
CWSANDBOX_API_KEY=... python deploy/cwsandbox/smoke_test.py

[brandonrjacobs]

Superseded by the upstream PR omnigent-ai#76 (same branch). Closing this fork-internal review PR.