feat(sandbox): add CoreWeave Sandbox (cwsandbox) provider

[brandonrjacobs]

Summary

Adds CoreWeave Sandbox (https://docs.coreweave.com/products/sandboxes) as a sandbox provider,
alongside Modal and Daytona. CWSandboxLauncher wraps the official
cwsandbox Python SDK as an
optional, lazily-imported extra (omnigent[cwsandbox]) — the same posture as
the existing modal/daytona launchers.

Supports both server-managed hosts (sandbox.provider: cwsandbox) and the
CLI bootstrap (omnigent sandbox create --provider cwsandbox). The only
unsupported primitive is forward_local_port (CW Sandbox has no local→sandbox
path), which is irrelevant here — managed hosts authenticate with a
server-minted launch token, not the Databricks App OAuth flow.

Changes

• omnigent/onboarding/sandboxes/cwsandbox.py — the launcher (provision / run /
  put / terminate + streaming exec / foreground).
• Register cwsandbox in the provider table and the server managed-host YAML
  config (SUPPORTED_SANDBOX_PROVIDERS, PROVIDERS_WITH_MANAGED_LAUNCH,
  factory + _parse_cwsandbox_* validators).
• pyproject.toml: cwsandbox extra + mypy override. uv.lock regenerated
  (pins cwsandbox 0.26.0).
• Unit tests (fake SDK via sys.modules, no network).
• deploy/cwsandbox/: README, a zero-dependency API smoke test, and a managed
  e2e driver.

Validation

Exercised end-to-end against production api.cwsandbox.com:

• API smoke test — provision → exec → AddFile → public egress → detach →
  terminate.
• Managed-host e2e — ran the Omnigent server inside a CW sandbox (public
  ingress), created a managed session, and the server provisioned a child CW
  sandbox running omnigent host that dialed back and registered.
• Real agent workload — the agent ran an LLM turn (via the openai-agents
  harness against an OpenAI-compatible CoreWeave inference endpoint) inside the
  managed sandbox and returned a correct answer.

Unit tests + ruff + mypy + uv lock --check all green.

Notes for reviewers

• _ensure_sdk() in __init__ is a deliberate workaround: the cwsandbox
  SDK installs signal handlers at import time, which raises when imported in a
  worker thread (the managed flow calls prepare()/provision() via
  asyncio.to_thread). Importing at construction (the main thread) sidesteps
  it. Removable once Import time signal handler install crashes from non-main threads such as marimo coreweave/cwsandbox-client#136 (PR
  fix: skip signal handlers outside main thread (#136) coreweave/cwsandbox-client#138) ships.
• uv.toml cooldown exemption. The repo's P7D exclude-newer cooldown
  can't yet resolve cwsandbox 0.26.0 (published within the window), so a
  scoped exclude-newer-package exemption for this one first-party SDK lets the
  lock pin the tested version; the global cooldown is unchanged for every other
  dependency. It can be dropped once 0.26.0 ages past P7D.
• The managed launch-token TTL is derived from
  OMNIGENT_CWSANDBOX_MAX_LIFETIME_S so it always outlives the
  (operator-overridable) sandbox lifetime.

Testing

pip install -e '.[cwsandbox,dev]'
pytest tests/onboarding/sandboxes/test_cwsandbox.py
# live API check:
CWSANDBOX_API_KEY=... python deploy/cwsandbox/smoke_test.py

[dbczumar]

Approving. Code-reviewed the cwsandbox provider and ran the unit tests, lint (ruff), and type checks (mypy) locally — all green. Pushed a small follow-up commit relocating the e2e/smoke scripts under tests/e2e/integrations/deploy/cwsandbox/ and fixing a ruff-format miss.

[dbczumar]

Re-approving the current head: merged main + provider-registry conflict resolution keeping both cwsandbox and islo, and README parity updates. Unit tests (cwsandbox+islo), ruff, and mypy pass locally on the merged tree.

[dbczumar]

LGTM! Thanks @brandonrjacobs !