feat(computer-image): Lambda microVM Computer rootfs with codewhale app-server + openvscode-server sidecar

Founder direction 2026-09-02 (Daytona out; AWS Lambda microVM in) + ratified IDE program stage 1 (PRD §6). The current Computer image is Daytona-shaped and must be rebuilt for the microVM substrate, and extended with the embedded editor sidecar.

## Current state

`computer/snapshots/cloud-agent/`: debian:bookworm-slim, digest-pinned `codewhale` binary, agent toolchain, non-root `agent` user, `/workspace`, `sleep infinity` entrypoint ("Daytona injects its own toolbox daemon"). The product dispatcher wiring for this snapshot is explicitly absent, and no credential bridge exists into the Computer.

## Deliver

- A reproducible **microVM rootfs** build replacing the Daytona snapshot: digest-pinned `codewhale` binary, agent toolchain, non-root user, `/workspace`, `codewhale app-server --http` on loopback inside the VM.
- An **openvscode-server (or code-server) sidecar** in the image for the cloud editor: bound to loopback only, no direct network exposure — always fronted by CWC (the apps control plane proxies `/v1/terminal/pty` today; the editor gets the same treatment, tracked in the apps cloud-editor issue).
- Credentials injected post-create only (create-time env forbids secrets today; keep that property).
- The codewhale VS Code extension preinstalled in the editor's extension directory, pointed at the in-Computer Runtime API.

## Acceptance

- Image builds reproducibly from CI (digest pinned).
- Inside a microVM: engine answers `/v1/runtime/info`, editor serves, extension connects to the local runtime.
- No listening service reachable from outside the VM boundary except through the CWC-fronted channel.

Start with the existing computer/snapshots/cloud-agent/ snapshot and PRD §6, then review the apps cloud-editor issue for the editor proxy context. Done means a reproducible digest-pinned microVM image builds in CI, the engine and editor serve inside the VM, the extension connects locally, and no service is externally reachable except through CWC.

Written by the indexing model from the issue text.