Sandbox/judge vendor spike: Testpress labs vs Judge0 vs Piston (+ grade QUIZ CODE_OUTPUT)

2-week timebox. CODE_LAB embed currently only works against Fermion labs (Testpress-dependent); DSA judge functions are dead exports; QUIZ CODE_OUTPUT is a dead enum (excluded from authoring validation/course.ts:163, always-wrong in grading learning.ts:188-198).

• If Testpress outreach lands: wire real school key → existing lab embed path E2E
• Judge0 self-host docker-compose spike (py/js/java/c++; per-user rate caps)
• Piston public API as zero-infra fallback for quick runs
• Feature flag judge.provider; wire ONE surface end-to-end: CODE_OUTPUT questions finally gradeable via code execution + stdout compare
• Meter all runs into SandboxSession; abuse cap/day server-side
• Decision doc: p95 latency, cost @10k runs/mo, ops burden

Spec: temp prompt library 06-sandbox-judge.

Start with the CODE_LAB embed path and inspect authoring validation in course.ts:163 plus grading in learning.ts:188-198. Review the temp prompt library 06-sandbox-judge and compare the Testpress, Judge0, and Piston options. Done means one provider is wired behind judge.provider, CODE_OUTPUT grading works with stdout comparison, runs are metered and capped, and the decision metrics are documented.