feat: Sandbox Runtime API v0.1 MVP

[kevinten10]

Summary

• complete the provider-neutral v0.1 lifecycle, command, file, event, HTTP/SSE, SDK, CLI, and Provider SPI
• add unsafe Local and deterministic Mock Providers plus bounded conformance checks
• add canonical OpenAPI/specification, bilingual guides, clean-room provenance, and release documentation
• make pnpm check the complete CI release gate: format, lint, typecheck, tests, docs, build, coverage, and package dry-run

Verification

• 83 tests across 5 files
• coverage: 88.93% statements, 84.80% branches, 93.04% functions, 91.15% lines
• public-content and Git history scan passed
• production dependency audit found no known vulnerabilities
• built CLI smoke passed health, create, file write/read, command, events, terminate, shutdown, and cleanup

Clean-room

This change was independently implemented from public sources and first principles. It contains no private code, internal API shapes, infrastructure identifiers, credentials, user data, or production responses.

Boundaries

The Local Provider is development-only and must not execute untrusted code. No production cloud or strong-isolation Provider is included.