feat(proxy): add OpenSandbox runtime backend

[zpzjzj]

Summary

• extract the existing Rocklet HTTP path behind a runtime backend interface
• route OpenSandbox command, file, streaming upload, and single-sandbox status operations through the OpenSandbox SDK
• proxy sandbox HTTP and WebSocket services through SDK-resolved endpoints, supporting both path-prefixed and host-only endpoint forms
• fail closed on missing, unknown, or operator-conflicting backend metadata; OpenSandbox never falls back to Rocklet or port 22555
• preserve ROCK command check/timeout semantics, file decode policy, existing file modes, and use 644 for new files
• return explicit 4xxx errors for OpenSandbox session and raw TCP portforward capabilities in this release

Verification

• ruff format --check: passed
• ruff check: passed
• focused runtime/proxy suite after service-proxy changes: 124 passed
• broader unit suite: 1870 passed, 28 skipped, 12 failed; one branch-induced websocket error-contract regression was fixed and reverified, while the remaining 11 failures are pre-existing Python 3.10 shell-test incompatibilities/flakes (including asyncio.timeout, which requires Python 3.11)
• community Docker HTTP/WebSocket smoke: passed after restoring the local Colima runtime
• local cold self-review against origin/master...HEAD: no actionable correctness findings after fixing path-prefix escape and reserved WebSocket-header handling found during the final security pass

Live Managed OpenSandbox-Compatible Endpoint E2E

Validated locally against a managed OpenSandbox-compatible endpoint with opensandbox==0.1.13, using Keychain-only credential injection (no credential written to files or logs).

• create -> Pending -> Running
• backend status mapping -> ROCK running
• string command and argv-list command execution
• check=True non-zero exit propagation
• first-write of a new UTF-8 file, then read-back
• first-upload of a new 5 MiB binary through UploadFile.file without whole-file buffering; remote SHA-256 matched locally
• service endpoint discovery returned a scheme-less host endpoint with required endpoint headers
• ROCK HTTP service proxy reached a container-local server on port 8080 and returned 200 with a non-empty response body
• delete cleanup completed

The service proxy keeps the SDK endpoint as the routing source of truth: a path-prefixed endpoint retains its path/query prefix, while any scheme-less endpoint receives the configured protocol. Request paths are appended beneath that endpoint, endpoint-required headers override client headers case-insensitively, and WebSocket URLs use the corresponding ws/wss scheme. Relative path segments and reserved WebSocket handshake headers are rejected/filtered so the endpoint capability boundary cannot be escaped or corrupted.

The live run found and this branch fixes two SDK integration gaps: get_file_info reports missing paths as FILE_NOT_FOUND rather than an empty mapping, and FastAPI SpooledTemporaryFile needs a streaming IOBase adapter for SDK 0.1.13.

Live Community OpenSandbox Docker E2E

Validated locally against opensandbox/server:latest with the Docker runtime, opensandbox/execd:v1.0.19, and opensandbox==0.1.13 after restoring the existing Colima environment.

• sandbox create -> Running, with cleanup completed after each run
• SDK endpoint discovery returned the real scheme-less path form: host:port/sandboxes/{id}/proxy/{port}
• direct HTTP endpoint returned 200; the same container-local port through OpenSandboxProxyService.http_proxy returned 200
• direct WebSocket endpoint echoed a text frame; the same endpoint through OpenSandboxProxyService.websocket_proxy echoed the frame successfully
• both default endpoint normalization and custom HTTP/WebSocket ports were exercised without Rocklet fallback

Delivery plan

To keep each review coherent while treating persistent sessions as a required capability, the remaining work is ordered as follows:

1. This PR — stateless runtime backend: command execution, file operations, streaming upload, status routing, HTTP/WebSocket service proxying, strict backend isolation, and explicit capability errors.
2. Next PR — persistent session support: implement OpenSandbox create_session / run_in_session / close_session, persist the (sandbox_id, ROCK session name) -> OpenSandbox session id mapping in Redis for multi-worker safety, and clean mappings on close/delete/expiry. This is a required follow-up rather than an optional last-mile enhancement.
3. Final integration/docs PR: gate Rocklet-only scheduler tasks for the OpenSandbox operator, add Admin-level integration coverage, and publish the user-facing OpenSandbox backend guide and final capability matrix.

The user-facing guide is intentionally last so it documents the stable post-session behavior instead of publishing a limitation that the immediately following PR would invalidate. To minimize review churn, feedback and CI fixes within each PR will be accumulated into a consolidated push where practical.

Deferred from this PR

• persistent OpenSandbox sessions — required and scheduled for the next PR
• raw TCP portforward over WebSocket
• scheduler task gating — scheduled for the final integration/docs PR
• mixed-operator migration within one admin
• remote command cancellation

Refs #1202

[zpzjzj]

已补齐 /sandboxes/{sandbox_id}/proxy/{path:path} 和自定义端口下的 HTTP/WebSocket 服务代理。实现以 OpenSandbox SDK 返回的 endpoint 为唯一事实来源：path-prefixed endpoint 会保留原有 path/query，scheme-less endpoint 会补配置协议，再追加目标 path；SDK 要求的 endpoint headers 会透传，OpenSandbox 路由仍 fail-closed，不回退 Rocklet。社区 OpenSandbox Docker 真实验证已覆盖 scheme-less path endpoint，HTTP 返回 200，WebSocket echo 成功。原始 TCP portforward over WebSocket 仍明确延期，不包含在本次 HTTP/WS 服务代理范围内。