feat(dev): add portable agent development sandbox

[krishicks]

Summary

This adds the ability to create an OpenShell sandbox to use as an OpenShell dev environment. It was oriented around being able to run mise run ci and also to use pi as your agent, though it also supports and includes evergreen claude and codex.

Because not all tests can run within a sandbox, some tests are skipped specifically when run in the sandbox. It would be good if we could modify these tests so that they would run in a sandbox, but that's out of scope for now as this is experimental.

This also only expects to use a gateway pointed at Podman; it also expects access to Podman directly so that it can build the image and stream it into Podman. It has some Podman auto-detection built in, or you can specify a host with --podman-host or a named Podman connection with --podman-connection; I use --podman-host because I have an SSH port forward to a beefy linux/amd64 machine running Podman that I wanted to use.

The OCI image is built using a multi-stage Dockerfile with buildkit provided by mise. We may decide to publish this image so that you don't have to (but still could) build it locally, but we'll see if this is useful enough to do that.

I've been running it with (after creating the github provider):

mise run sandbox:dev -- --cpu 8 --memory 16Gi --provider github --podman-host tcp://127.0.0.1:29090

You can also recreate the sandbox:

mise run sandbox:dev -- --recreate

Or rebuild the image and recreate the sandbox:

mise run sandbox:dev -- --rebuild-image

By default it uses the active/current OpenShell gateway; choose a different one with OPENSHELL_GATEWAY=other-gateway.

This doesn't use the builtin codex or claude providers because the binary paths in those policies differ from what get installed in this image, and it also seemed maybe better to just maintain our own single policy rather than relying on built-in providers.

I'd like it if we could sign commits within the sandbox, but doing that I think will require inventing something new for OpenShell so that we can delegate signing to something on the host so that we don't either give the sandbox any signing keys or end up allowing the sandbox arbitrary access to the signing oracle. The sandbox should only sign git commits, for example, and probably only those commits we want it to be able to sign, which may imply some kind of approval process or signing policy.

For now this is mostly convenient as a way to run tests and do agent investigation in the repo. Because the OpenShell repository is not bind-mounted into the container it doesn't modify files on the host, and also because it can't sign commits anyway we need to get any changes made in the sandbox out and back onto the host; I'm going to explore this next. It'll probably be some process of having the agent generate a git patch which we can then download and apply locally, then make a signed commit and push from the host.

Related Issue

Changes

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)