Add DigitalOcean Managed Agents as a sandbox backend

[nkurraDO]

Adds a tenth sandbox backend that runs each qm computer as a DigitalOcean Managed Agents microVM.

Sessions are created with agent: none, which asks for a bare sandbox: no managed agent loop, no event-translation runtime, and no model credential of its own. qm keeps its own agent loop and its own approval gates, and the provider supplies the machine.

How it talks to the provider

Two planes, deliberately:

• Session lifecycle is bearer-authenticated REST under /v2/agents/sessions, with a DigitalOcean IAM token carrying the team identity that owns the sessions.
• Exec and file transfer go over a WebSocket port-forward to guest port 8443, bridged to a local TCP listener, carrying gRPC to the sandbox-agent every microVM runs.

The second plane exists because the REST exec endpoint buffers in the control plane: it clamps to four minutes and 1 MiB and carries no per-command environment, which rules it out for a general-purpose sandbox. The port-forward has no request deadline, so a command is bounded by qm's own SANDBOX_TIMEOUT_SEC.

Configuration

SANDBOX_BACKEND=do-managed-agents
DO_AGENTS_API_TOKEN=...
DO_AGENTS_SNAPSHOT_S3_BUCKET=...

The bucket matters more than it looks. The provider exposes session checkpoints, but qm does not capture them yet, so a portable tar is the only recovery path: without the bucket, a destroyed or reclaimed session takes the scope's home with it.

Two things worth a reviewer's attention

The vendored proto is a stopgap, not a preference. Every other backend consumes a published SDK. This one vendors managed-agents-sandbox-agent.proto, which means one wire with two owners in two repos. It is there only because the buffered REST endpoint cannot carry a general sandbox. When streaming exec reaches the public edge, the vendored proto, the tunnel, and both gRPC dependencies all go away. The ADR records this.

Deleting a conversation does not delete the microVM. This backend implements no deep-idle reaping, so a scope's machine outlives the conversation and is reclaimed by the provider's idle timeout or an explicit retire. DO_AGENTS_IDLE_TIMEOUT_SEC is the backstop. That is a deliberate choice to document rather than a gap to fix quietly, and docs/managed-agents.md says so.

Testing

The fake control plane answers the session REST surface and serves a real WebSocket port-forward bridged to a real gRPC sandbox-agent over a temp directory, so the tests exercise the actual wire path — upgrade, bridge, exec, upload, download — rather than a stub of it.

The cases covered are the ones that are cheap to get wrong and expensive to debug in production:

• A port-forward the edge refuses reads as a retryable gone error carrying the rejection text, not as a command that may have half-run. Getting this wrong turns a connect failure into a non-retryable "may have partially executed".
• A transient lifecycle failure while waiting for readiness is polled through; one that never clears surfaces its own status rather than a readiness timeout.
• Pause and resume preserve the home, scratch sandboxes are reference counted and never persisted, and the egress allowlist is only claimed when a proxy is actually configured.

Verification on this branch: typecheck, lint, and knip clean; the two backend suites pass 41/41; the live smoke passes end to end against the real provider, including pause and resume.

On the full suite, this branch reports 8348 tests with 285 failures. Clean main at the same commit reports 8305 tests with the same 285 failures and the same 9 cancelled, so the branch adds 43 tests, all passing, and introduces no new failures. The 285 are pre-existing on main and unrelated to sandboxes.

Each of the three commits typechecks standalone.

[v-aisac]

LGTM

[16francej]

Thanks @nkurraDO! Moving this to #2128, a branch in the main repo, so the full CI suite can run. Same commits, your authorship is kept. Closing in favor of #2128.