perf(sdk): streamline local and cloud dependencies

[appcypher]

TL;DR

Split the Rust SDK into explicit local and cloud feature surfaces, and keep the existing all-capabilities default. A cloud-only SDK build now avoids the local database, image, migration, metrics, VM runner, and host-network-engine dependency trees.

This PR is stacked on #1454 (appcypher/sdk-runtime-bootstrap). After #1454 merges, this PR should be retargeted to releases/v0.7.0.

Description

• Add local and cloud SDK features while leaving both enabled by default.
• Keep snapshots and image-archive support inside local, as requested, instead of exposing product-level features for them.
• Make download-binaries and embed-binaries imply local; keep Agentd packaging owned by the msb build.
• Split microsandbox-runtime into physical client/ and runner/ trees, preserving its existing default behavior and public paths while letting the SDK compile only the lightweight client contract.
• Split microsandbox-network into physical model/ and engine/ trees, preserving its existing default behavior and public paths while letting the SDK compile only configuration and policy types.
• Move RegistryAuth and the shared log-level contract into microsandbox-types while preserving existing public re-export names.
• Remove unused direct dependencies from the SDK, runtime, image, network, metrics, and utils crates.
• Document the supported feature combinations and add CI checks for them.

The intentional compatibility boundary is limited to internal crates built with default-features = false: callers that need the VM implementation must now enable runtime runner, and callers that need the host networking implementation must enable network engine. Published defaults and the SDK's default behavior remain unchanged.

Build Performance

Metric	Before (#1454)	After (#1479)	Difference	Improvement
Debug build	66.22s	44.98s	-21.24s	32.1% faster
Release build	99.40s	78.37s	-21.03s	21.2% faster
Dependencies	526	432	-94	17.9% fewer
Debug build directory	2,495,848 KiB	1,952,260 KiB	-543,588 KiB	21.8% smaller
Release build directory	1,150,812 KiB	973,772 KiB	-177,040 KiB	15.4% smaller

Measured on an Apple Silicon Mac using clean target directories, CARGO_INCREMENTAL=0, --locked, the same local runtime artifacts, and a warm Cargo source cache. Each timing is one clean SDK library build. The cloud-only surface has 230 dependencies and built in 27.60s debug and 44.45s release under the same conditions.

Test Plan

• cargo fmt --all -- --check
• cargo clippy --workspace --exclude microsandbox-agentd -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo doc --workspace --exclude microsandbox-agentd --no-deps
• cargo check -p microsandbox --no-default-features --features cloud,net
• cargo check -p microsandbox --no-default-features --features local,net
• cargo check -p microsandbox-runtime --no-default-features --features client,net
• cargo check -p microsandbox-network --no-default-features
• cargo check -p microsandbox-cli --no-default-features
• cargo test -p microsandbox-network --lib (486 passed)
• cargo test -p microsandbox-runtime --lib (137 passed)
• cargo test -p microsandbox --lib --no-default-features --features cloud,keyring,local,net (620 passed, 3 ignored)
• cargo check in sdk/rust/fuzz
• Real macOS microVM boot, guest command execution, stop, and cleanup through the Rust SDK

[greptile-apps]

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  SDK[microsandbox SDK]
  SDK -->|local| Local[Local backend and runtime client]
  SDK -->|cloud| Cloud[Cloud HTTP/WebSocket backend]
  SDK -->|net| NetTypes[Network configuration and policy types]
  Local --> Runner[msb runtime runner]
  Runner --> Engine[Host network engine]
  Ruby[Ruby extension: net + ssh] --> SSH[SSH module]
  SSH -. calls .-> LocalAccess[Local-only accessors]
  LocalAccess -. unavailable without local .-> BuildFailure[Compilation failure]

Loading

Prompt To Fix All With AI

### Issue 1
sdk/rust/lib/sandbox/mod.rs:659-660
**SSH loses local accessors**

When the Ruby extension builds the SDK with `default-features = false` and `features = ["net", "ssh"]`, the SSH module calls `Sandbox::local()` and `Backend::as_local()` even though this change compiles both methods only with `local`, causing the Ruby extension and equivalent SDK configurations to fail compilation.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "perf(sdk): streamline local and cloud de..." | Re-trigger Greptile}

[greptile-apps]

SSH loses local accessors

When the Ruby extension builds the SDK with default-features = false and features = ["net", "ssh"], the SSH module calls Sandbox::local() and Backend::as_local() even though this change compiles both methods only with local, causing the Ruby extension and equivalent SDK configurations to fail compilation.

Knowledge Base Used: Restore local SDK feature parity

Prompt To Fix With AI

This is a comment left during a code review.
Path: sdk/rust/lib/sandbox/mod.rs
Line: 659-660

Comment:
**SSH loses local accessors**

When the Ruby extension builds the SDK with `default-features = false` and `features = ["net", "ssh"]`, the SSH module calls `Sandbox::local()` and `Backend::as_local()` even though this change compiles both methods only with `local`, causing the Ruby extension and equivalent SDK configurations to fail compilation.

**Knowledge Base Used:** [Restore local SDK feature parity](https://app.greptile.com/microsandbox/-/custom-context/knowledge-base/superradcompany/microsandbox/-/reverts/rollback_1091-20260703-sdk-local-feature-regressions-e5fe3ef.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Too many files changed for review (135 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.