feat(agent): add Docker sandbox backend for agent run

[radim10]

Summary

Adds an opt-in Docker sandbox backend for agent run — a stronger alternative to the native Seatbelt/systemd-run/bubblewrap backend, running the agent inside an isolated container instead of a same-host sandboxed process.

Key properties:

• Filesystem: allow-list, not deny-list — only the working directory is visible inside the container at all, instead of specific paths being blocked while everything else stays reachable.
• Network: enforced by a real firewall inside the container's own network namespace (a short-lived privileged holder container installs iptables default-DROP rules, then verifies they actually took effect before trusting them), not by the agent choosing to honor HTTPS_PROXY/HTTP_PROXY. Verified this holds under a real adversarial bypass attempt (raw socket to an arbitrary host, and an attempt to flush the firewall from inside the agent container — both fail as designed). DNS gets no exception at all, closing a data-exfiltration channel that no per-container firewall rule could otherwise block (Docker's embedded resolver forwards unresolved lookups via the host's own DNS stack, outside the container's network namespace entirely).
• Capabilities: agent container runs with --cap-drop ALL, no-new-privileges, --init (proper zombie reaping/signal handling), and a --pids-limit (fork-bomb containment) — always on, no configuration needed.
• Cross-platform: works on macOS, Linux, and Windows (via Docker Desktop), handling each platform's different container-to-host networking model.

Configurability:

• [sandbox] image / dockerfile — run a custom image or build one from a project-supplied Dockerfile, for anything beyond the maintained default (Claude Code + Codex pre-installed, plus common tooling including Python). None of the sandbox constraints above can be loosened by a custom image.
• [sandbox] memory / cpus — optional resource caps (opt-in, no default, since an automatic cap could silently break a legitimate heavy task).
• Matching CLI overrides for a single invocation: --docker-sandbox, --docker-image, --docker-dockerfile, --docker-memory, --docker-cpus.
• New agent docker command group: build, status, cleanup (finds and removes leftover containers/networks from a crashed run — every resource is named after its own session id, so it's traceable), doctor (readiness check without starting a real sandboxed run).

Also included:

• Git identity forwarding, persistent login/config across runs (shared named volume), Codex device-code login support (normal OAuth can't work from an isolated container).
• agent validate now checks Docker readiness instead of native-backend mechanisms for a Docker-backend profile, so it doesn't falsely report Windows as unsupported for a profile that doesn't need the native backend at all.

Testing

• 308 tests, run and passing on macOS, Linux (native, via a real container — not just cross-compiled), and Windows CI.
• Docker-gated integration tests exercise the firewall (self-verification, DNS blocking, proxy-only egress), container resource limits, and image lifecycle against a real Docker daemon; they skip cleanly when Docker isn't available.
• Extensively verified by hand against real Docker throughout development: full agent sessions with Claude Code and Codex, credential injection through the sandboxed network path, custom images/Dockerfiles, resource limits, and crash-cleanup scenarios.

Known limitations

• No CPU/memory cap by default (opt-in only, by design).
• A pre-existing, unrelated Windows path-separator bug in directory-profile loading was fixed along the way (config.rs) since it was blocking this branch's CI, but it isn't part of the Docker sandboxing feature itself.