Support declarative artifact delivery and stable endpoint for governed sandboxes

Problem

A control plane needs to deliver a digest-pinned bridge artifact to a sandbox and expose it through a stable, replacement-safe endpoint. The pinned SDK currently exposes a whole SandboxSpec.image, environment, labels, and providers, but no declarative artifact/sidecar delivery or endpoint lifecycle surface.

Using a controller-created Kubernetes Service selector or direct pod exec/copy is unsafe here: a sandbox replacement can reuse names while changing identity, and it bypasses the gateway lifecycle.

Requested capability

Please provide (or document a supported composition of) a gateway-owned API that lets a caller:

1. Declare one or more immutable OCI artifacts by digest for a sandbox, without direct pod exec/copy.
2. Attach a long-running artifact/process to the sandbox lifecycle with an observable readiness condition.
3. Obtain a stable, authenticated endpoint that follows the currently active sandbox and fails closed while a replacement is not ready.
4. Preserve sandbox identity/UID binding so a replaced sandbox cannot inherit the previous endpoint or authority.

The caller can supply only digest-pinned, independently provenance-verified artifact coordinates. OpenShell should remain responsible for artifact installation, process lifecycle, routing, and teardown.

Acceptance evidence

• A sandbox replacement changes the concrete target but retains the stable endpoint only after the new artifact is Ready.
• Stale artifact/process state is unreachable after replacement or teardown.
• No Kubernetes pod access or mutable caller-managed Service selector is required.

We can contribute a neutral integration test once a proposed API/contract is available.

Start by reviewing the pinned SDK's SandboxSpec.image and the gateway lifecycle requirements described in the issue; no implementation files or tests are identified. Define the proposed API or contract first, then validate it against the replacement, readiness, stale-state, identity, and no-pod-access acceptance evidence.