feat: integrate openclaw/crabbox as AgentENV sandbox client

[zozo123]

Summary

• Integrate the upstream openclaw/crabbox CLI as an AgentENV sandbox client through Crabbox's built-in e2b provider
• Add a safe config/crabbox.example.yaml containing only project-scoped template/workdir settings (no endpoint or credentials)
• Document the required AgentENV host-based sandbox proxy domain, wildcard DNS, TLS, environment variables, lifecycle commands, limits, and troubleshooting
• Add CI that installs pinned Crabbox v0.40.0 with SHA-256 verification, loads the real config, and exercises list/create/connect/archive-sync/process/delete against a strict E2B contract server
• Keep the integration wrapper-free: users install and run upstream crabbox directly

Important deployment requirement

Crabbox's e2b provider sends file and process traffic to https://{port}-{sandboxID}.{domain}; it does not read E2B_SANDBOX_URL. AgentENV must therefore advertise [sandbox_proxy].domains[0] (or AENV_SANDBOX_PROXY_DOMAINS) and expose wildcard DNS + TLS for that domain. A loopback-only E2B_API_URL is sufficient for doctor and list, but not for warmup or run.

Validation

• Crabbox v0.40.0 release asset checksum verified against the upstream release
• config/crabbox.example.yaml loaded by Crabbox with required 0600 permissions
• E2B contract smoke: authenticated list, sandbox create/connect, archive upload, envd process stream, command output, and one-shot delete
• actionlint -no-color .github/workflows/crabbox.yml
• ruff check and ruff format --check for the contract server
• pyright scripts/tests/crabbox-e2b-contract-server.py
• make fmt
• make docs
• Upstream Crabbox delegated-run sanity smoke through Islo
• Live crabbox run --provider e2b against a KVM-backed AgentENV deployment with wildcard DNS/TLS (requires deployment infrastructure not available in this checkout)

[zozo123]

Islo verification (openclaw/crabbox)

Validated upstream crabbox against Islo while preparing this PR (no in-repo wrapper):

1. islo api-key create … --show → export ISLO_API_KEY=…
2. crabbox doctor --provider islo → ok (auth=ready)
3. crabbox list --provider islo --json → ok
4. crabbox run --provider islo --islo-vcpus 2 --islo-memory-mb 2048 --islo-disk-gb 10 --no-sync -- echo crabbox-islo-ok → pass (crabbox-islo-ok, lease slug quick-crab)

AgentENV usage remains --provider e2b + E2B_API_URL / config/crabbox.example.yaml.

[github-actions]

✅ OpenCodeReview: No supported files changed.

[yingdi-shan]

Thanks for your contribution! Integrations with other tools can improve AgentENV's usability, so this is a welcome addition. That said, I think we should keep this minimal: add a short section on how to configure it, plus a link, rather than updating the README and docs extensively or modifying the code for the integration test.

[zozo123]

Implemented the requested minimal shape on the current head: Crabbox is now a 19-line subsection of the existing docs/src/integration/e2b.md. The standalone page, README entry, SUMMARY entry, overview entry, and quickstart entry are removed; there are no code or workflow changes. The subsection contains only the three primary configuration variables, two example commands, the host-routing constraint, and one upstream provider link. The resulting PR diff is one documentation file, and git diff --check passes. Ready for re-review.