feat(sandbox): pluggable sandbox seam with snapshot, rewind, and teleport

[justrach]

Inspired by exoharness/exo's sandbox system — the one piece of its architecture we clearly lack.

Design sketch:

• src/sandbox.zig: vtable seam with two roles — a backend (acquire a sandbox, acquire-from-snapshot) and a handle (exec, start process, snapshot). Mirrors the ManagedSandboxBackend/ManagedSandboxHandle split.
• First backend: Docker via CLI only (no SDK): snapshot = docker commit -p <ctr> graff-snap-<id> + docker save to a tar blob; restore = docker load + docker run with the image swapped in; evict any warm container for the key first. AppleContainer (container CLI) is the same wire with a different binary.
• Snapshots persist under .graff/sessions/<id>/snapshots/<snap>/{manifest.json,payload.bin}; the conversation log stays canonical and is never rewound with the sandbox — filesystem state only, processes relaunch.
• REPL: /snapshot and /rewind <id>.
• Teleport = restore a DockerImageTar snapshot on a different backend (e.g. Daytona), which we already use by hand for Windows verification.

Why we want it: the bot sandbox runner (zigrepper#136 phase 2), DGM trial isolation beyond git worktrees, and try-risky-thing-then-rewind workflows.

Known exo limitations to avoid repeating: whole payload held in memory during capture/restore; no snapshot GC.

[justrach]

Triage 2026-08-28 (main + release/v0.0.280).

Shipped (commit 9471772, announced in CHANGELOG v0.0.265; files present on both branches):

• src/sandbox.zig vtable seam (Backend / Handle, acquire + acquireFromSnapshot)
• Docker CLI backend (src/sandbox_docker.zig): commit/save, load/run, warm-key eviction, payload streamed disk-to-disk (the exo in-memory pitfall)
• REPL: /snapshot, /snapshot attach [image], /snapshot detach, /snapshot list, /rewind <id> (filesystem only; conversation rewind stays /rewind <n>)
• Tests hooked from src/test_hooks.zig (sandbox_tests.zig fake-docker orchestration)

Still open on this issue (not parked in an ADR):

• Teleport as a product path: restoring a docker_image_tar on a different backend (Daytona / Apple Container). bin_name and acquireFromSnapshot are the wire; there is no second snapshot-capable backend and no /teleport.
• Snapshot GC (named in the original sketch as the other exo miss to avoid).
• ADR 0037 still points experiment-pool Docker snapshots here.

Leaving open.

[justrach]

Teleport + snapshot GC are on #677 (ADR 0042).

• /teleport <id> [docker|container] restores a docker_image_tar onto the Apple Container CLI (same wire, different bin_name). Missing dest CLI stays an explanation.
• /snapshot gc [n] keeps the newest n snapshot trees (default 1).
• Conversation is still never rewound.

Daytona is still not a backend.

[justrach]

Fully delivered across two cuts: the snapshot/rewind seam shipped in v0.0.265, and v0.0.282 (ADR 0051 / #677) completes it with /teleport <id> [docker|container] — restoring a captured docker_image_tar onto another CLI backend, Apple Container as the second backend — plus /snapshot gc [n]. The conversation is never rewound and missing CLIs explain rather than crash.