feat(sandbox-adapter): add Freestyle provider

[eersnington]

Adds a Freestyle sandbox provider at @rivet-dev/sandbox-adapter/freestyle. Ironworks keeps its own copy of this provider; it can import this one after the release.

sandbox: freestyleProvider({
	create: { snapshotId: "freestyle/ubuntu-sm", firewall: { rules: [/* ... */] } },
}),

Lifecycle

Event	Freestyle call
First tool use	vms.create(create). create can be a function of the Actor context.
Wake	vm.start() if the VM is not running. A missing VM returns undefined, so a new one is created.
Sleep	vm.pause()
Destroy	vms.delete()

Commands

vm.exec cannot stream output or stop a command. exec opens a PTY session that runs a Python bridge:

exec(command)
 └─ vm.pty.open(python3 bridge)          runs as root
     ├─ stdin: {command, cwd, env}         not in the session URL
     ├─ stdout/stderr frames → onData
     ├─ exit frame → result
     └─ vm.pty.close()                     kills the process group on exit, timeout, or abort

The VM image must include Python 3. freestyle/ubuntu* snapshots do.

Changes from the Ironworks copy

Ironworks	This PR
timeoutMs: 0 times out at once	0 means no timeout, as SandboxExecOptions documents
new Freestyle() runs when the provider is defined	The client is created on first use, like daytonaProvider
The provider has no cwd	cwd defaults to /workspace, so Pi builds tools before the VM connects
client takes FreestyleOptions	client takes a Freestyle instance, like daytonaProvider

Package and docs

• freestyle@^0.2.16 is an optional peer dependency.
• scripts/test-packed.mjs checks that dist/freestyle.js is packed.
• The Sandboxes page has a Freestyle section, a providers table row, and a diagram entry. The quickstart and the docs index list Freestyle. The example is examples/docs/sandboxes/freestyle.ts.

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.