Add a provider-neutral remote sandbox runtime

[algoflows]

Related issue

N/A

Summary

This adds a small, provider-neutral remote sandbox backend to Omnigent.

ELI5

Omnigent runs the conversation; a platform service runs the computer behind it. This PR gives Omnigent a standard plug for that platform service.

Omnigent session
      |
      v
remote sandbox adapter  -- authenticated HTTP -->  runtime service
                                                     |
                                                     v
                                              sandbox provider

The existing direct Daytona backend remains available for installations that prefer Omnigent to manage Daytona itself.

What changed

• Added a remote sandbox backend for create, command, resume, stop, delete, status, and activity operations.
• Added provider-neutral hooks for launch identity and active/idle status.
• Propagated Omnigent session activity to the correct managed host and sandbox.
• Added safe retries for idempotent operations when the network or provider fails transiently.
• Bounded remote response bodies before parsing, including bounded error messages.
• Kept provider credentials and organisation-specific lifecycle policy out of Omnigent's managed-host code.
• Made detached remote host commands durable so the host survives the short request that launched it.

Why this is easier to maintain

Organisation-specific lifecycle code no longer needs to be merged into Omnigent whenever upstream changes. A downstream platform can implement the stable HTTP interface while this repository retains only the small generic adapter.

Test plan and evidence

• pre-commit run --all-files: passed.
• Remote adapter plus managed-host tests: 135 passed.
• External session activity/status tests: 8 passed.
• Managed wake tests: 3 passed.
• GitHub security gates, Docker build, Windows checks, integration checks, pre-commit checks, and all four API E2E shards passed.
• Verified authenticated requests, response limits, transient retries, activity propagation, and correct host-to-sandbox mapping.
• Verified against Tellimer's real production runtime controller and Daytona infrastructure.
• A full production cold-session test passed:
  • initial model response OMNIGENT_REMOTE_E2E_OK_ff37fa8e;
  • stop and automatic wake of the same runtime;
  • preserved filesystem state;
  • post-wake model response OMNIGENT_REMOTE_E2E_WAKE_OK_ff37fa8e;
  • successful session and runtime cleanup.

The maintainer-approval gate is expected to remain unsuccessful until an upstream maintainer approves the contribution. The remaining server-rest failures concern session snapshot/model caching and a pre-existing OpenAPI artifact mismatch; the UI shard failures concern settings, themes, and unrelated screens. None exercise the remote sandbox adapter. The adapter-specific suites, all four API E2E shards, and the real production lifecycle test passed.

Type of change

• Bug fix
• Feature
• UI / frontend change
• Refactor / chore
• Docs
• Test / CI
• Breaking change

Changelog

Omnigent can run managed sessions through a provider-neutral remote sandbox service, including activity-aware sleep and automatic wake.