feat(sandboxer): pluggable runtime provisioner across all providers

[dungdm93]

Summary

Implements pluggable runtime provisioning across all sandboxer providers (container, incus, and host) using a decorator-pattern Provisioner[Req].

Key Changes

1. Generic Provisioner & Operations:
   • provision.Provisioner[Req any] wrapping provision.Launcher[Req any] (func(ctx context.Context, req Req) (sandboxer.Sandbox, error)).
   • Zero default operations in provisioner; operations are explicitly injected by provider factories.
   • Concurrently executes Prepare across all runtimes (parallel(pull -> mount)) with peer cancellation, sequential PreLaunch request mutation, inner launcher execution, and sequential PostLaunch.
   • Cleans up mounted resources during failure rollback or on sandbox termination in LIFO order.
2. Provider Implementations:
   • Container: AddBindMount() injects bind mounts into *types.ContainerSpec; unwraps decorated sandbox to extract containerId.
   • Incus: AddDiskDevice() injects disk devices into cloned *Template; unwraps decorated sandbox to extract Dialer.
   • Host: Symlink[Req]() creates host directory symlinks during PostLaunch and removes them on sandbox termination.
3. Sandbox Unwrap Utility:
   • sandboxer.Unwrap(sb) recursively unpacks nested decoratedSandbox instances to retrieve the underlying concrete sandbox.
4. Testing:
   • Thorough unit and integration tests across runtime/provision, sandboxer, container, incus, and host.
   • Built and tested with CGO_ENABLED=0 go test -tags containers_image_openpgp ./....