feat(proxy): support persistent OpenSandbox sessions

[zpzjzj]

Summary

• implement OpenSandbox create_session, run_in_session, and close_session through the official SDK
• persist (sandbox_id, ROCK session name) -> OpenSandbox session id mappings in Redis so sessions work across Admin workers
• use expiring, owner-checked Redis reservations for concurrent create/rollback/close safety and clear mappings after sandbox deletion
• preserve ROCK duplicate/missing-session, check, timeout, startup-source, and explicit environment semantics
• use the sandbox/container effective user by default; accept an explicit remote_user only when it matches that effective user, otherwise return a clear 4xxx unsupported error
• keep interactive session actions explicitly unsupported; do not copy the Admin process environment when env_enable=true

Compatibility behavior

OpenSandbox execd owns the persistent shell process, so the session naturally inherits the sandbox/container environment and effective user. ROCK does not install or fall back to Rocklet on this path.

For remote_user:

• omitted: use the image/container effective user
• equal to the effective user: allowed
• different from the effective user: rejected before creating the session, rather than silently executing as another user

Explicit env values and startup_source files are initialized inside the new session. Environment names and shell values/paths are validated or quoted before execution.

Concurrency and cleanup

The Redis registry uses optimistic transactions and opaque reservation ownership tokens:

• duplicate session names are reserved atomically across workers
• abandoned create reservations can be reclaimed after expiry
• a stale creator cannot commit or roll back a newer reservation
• a stale concurrent close cannot remove a replacement session mapping
• initialization/commit failures clean up the remote session without masking the original error
• sandbox deletion clears mappings best-effort after the irreversible remote kill

Verification

• ruff format --check on all changed files: passed
• ruff check on all changed files: passed
• git diff --check: passed
• focused OpenSandbox client/operator/backend/registry/proxy/routing plus lifecycle/admin regression suite: 182 passed
• live community OpenSandbox Docker session canary: passed (create, persistent cwd/env across calls, default effective user, explicit matching user, mismatched-user rejection, close/delete cleanup)
• live managed OpenSandbox-compatible direct-endpoint session canary: passed with the same persistence/user/cleanup coverage; credentials were injected from Keychain and were not written to source, files, or logs
• live managed deletion proof: deleting a running ROCK sandbox invoked OpenSandbox kill, removed the remote sandbox, and cleared the Redis session registry
• broader fast suite reached 726 passed before a known baseline Rocklet Docker startup failure (test_docker_deployment: Container process terminated) and a subsequent Rocklet container-start hang; the same failure reproduces on unmodified master and does not touch this PR's OpenSandbox paths
• final manual cold review found and fixed stale create-reservation poisoning, stale-owner commit/rollback, concurrent-close replacement deletion, and post-kill cleanup error handling before the final focused run

Delivery plan

This is the required second step from #1233's delivery plan:

1. feat(proxy): add OpenSandbox runtime backend #1233 (merged): stateless runtime backend, files/uploads, status routing, and HTTP/WebSocket service proxying.
2. This PR: persistent OpenSandbox sessions with multi-worker-safe Redis mappings and cleanup.
3. One final integration/docs PR: gate Rocklet-only scheduler tasks for the OpenSandbox operator, add Admin-level integration coverage, and publish the user-facing backend guide and final capability matrix.

The user-facing guide remains last so it documents stable post-session behavior. Raw TCP portforward over WebSocket, mixed-operator migration within one Admin, and remote command cancellation remain outside this PR.

Refs #1202