feat(sandbox): publish E2B and Cube Session files

[yanpgwang]

Problem, rationale, and scope

E2B and CubeSandbox preserve durable Session workspaces and run package-configured tools, but they reject File-backed Session Resources and /mnt/session/outputs. Switching an otherwise identical cloud Environment to either provider therefore removes input and deliverable workflows that Docker, OpenSandbox, and Daytona already support.

Acceptance criteria:

• E2B and Cube materialize, validate, replace, reattach, and remove File Resources through the pinned provider SDK.
• File tools and shell commands share /mnt/session/outputs, and idle publication receives a repeatable validated archive.
• Provider-owned markers, output staging, cleanup, resource locking, timeout, and retry semantics match the existing remote contract.
• Capability admission, offline conformance, opt-in live conformance, deployment guidance, and capability documentation agree.

Non-goals: streaming E2B/Cube SDK transfers, read-only remote copies, remote Skills or Memory, heterogeneous-worker routing, Environment Work, or changing the Files HTTP API.

What changed

• Extend the shared E2B-compatible sandbox with File Resource, Session Output, and resource-synchronization capabilities.
• Adapt the pinned CubeSandbox Go SDK whole-value filesystem operations to Mango internal Reader interfaces for both E2B and Cube.
• Reuse the existing random tar snapshot, operation-deadline, retry, validation, and cleanup path.
• Add both providers to shared offline File/output conformance and their credential-gated live suites.
• Document the accepted Preview limitation: each File Resource and output archive is buffered in worker memory, uses provider-default modes, and is writable inside the sandbox.

Verification

• make verify
• make docs-check
• make security
• make local-config
• make image-smoke
• make test-service
• E2B/Cube live conformance is credential-gated and was not run locally; both live suites now include File Resources and Session Outputs.

API and migration impact

No route, JSON shape, OpenAPI schema, database schema, or migration changes. On the existing /v1 contract, cloud Environments backed by E2B or Cube now admit File Session Resources and publish Session outputs instead of returning an unsupported-capability error. Mango remains pre-release, so this capability change is made in place.

Durability and security

• Imports retain size/SHA-256 validation, pending/final identity markers, stale-delete protection, and attach recovery.
• Output snapshots use fixed tar arguments, random adapter-owned paths, operation-level deadlines, repeatable reads under the resource lock, close-time deletion, and Mango two-pass archive validation.
• File tools cannot address adapter-owned marker or staging roots.
• The E2B/Cube compatible Go SDK currently buffers whole files and does not expose per-operation modes. This is an explicit Preview resource-consumption and permissions limitation accepted for this slice; operators must size worker memory for the largest admitted transfer.
• Provider credentials remain worker-local and never enter public resources or PostgreSQL.

Design provenance

This change reuses Mango existing File Resource and Session Output contracts rather than adding provider-shaped public fields. The CubeSandbox Go SDK and E2B-compatible envd filesystem API are implementation data planes only. Adopted behavior, provider-specific buffering, and rejected compatibility obligations are recorded in docs/provenance.md and docs/sandboxes.md.

Checklist

• User-visible problem, acceptance criteria, and non-goals are recorded.
• Tests cover behavior that failed before this change.
• Documentation and capability claims are updated.
• Material provider influences and Mango-owned decisions are recorded.
• No credentials, generated artifacts, or local databases are included.