epic: built-in sandbox providers

Goal

Users can run execution-isolated environments on the compute backend of their choice through a single provider-neutral sandbox API — each provider pre-built, tested, documented, and validated on at least one real runtime.

Why this matters

Environments that execute agent artifacts shouldn't hard-wire a backend. Selecting a provider should be a YAML change, not a server rewrite. (Ties to the sandbox API foundations in NVIDIA-NeMo/Gym#1337 and the unified-infra epic NVIDIA-NeMo/Gym#1048.)

Acceptance Criteria (per provider)

• Provider class implementing SandboxProvider, registered in registry.py
• YAML config + example, selectable via sandbox_provider
• Passing tests (skip-guarded if the backend/SDK isn't installed)
• README documenting setup + the isolation/security properties it gives
• Validated end-to-end on ≥1 runtime (rollouts collected)

Out of scope

• The sandbox API / handle contract itself (NVIDIA-NeMo/Gym#1337, NVIDIA-NeMo/Gym#1048)
• Cluster orchestration / deployment guides (k8s install, OpenShift catalogs)
• Legacy per-server subprocess isolation (tracked as tech debt below)
• Running the Gym control plane itself on Kubernetes/OpenShift (PR NVIDIA-NeMo/Gym#1231). That's "where Gym runs," not "where sandboxes run."

Providers

• OpenSandbox — landed in main (runtimes: Kubernetes [EKS / GKE / OpenShift], local Docker)
• ECS Fargate — NVIDIA-NeMo/Gym#1686 (PR NVIDIA-NeMo/Gym#1645)
• Daytona — NVIDIA-NeMo/Gym#1687 (PR NVIDIA-NeMo/Gym#1513)
• E2B — NVIDIA-NeMo/Gym#1953
• Apptainer — NVIDIA-NeMo/Gym#1688
• Enroot NVIDIA-NeMo/Gym#1881
• Local Docker — NVIDIA-NeMo/Gym#1695
• Local Process — NVIDIA-NeMo/Gym#1696
• OpenShell — NVIDIA-NeMo/Gym#1689
• Modal — NVIDIA-NeMo/Gym#1690

Tech debt

• Migrate legacy Apptainer/Singularity per-server execution (#928, #1182, #1507,
  swerl_gen, swe_agents) onto the provider protocol — see NVIDIA-NeMo/Gym#1048

Reference Arch Design