Set a writable guest HOME and shared COREPACK_HOME, expose bunx, redirect
npm/pnpm global installs to a PATH dir, lift Debian's externally-managed
pip guard, and verify the toolchain as an unprivileged uid at build time.
Provision passwd/group/shadow entries for the numeric exec uid at sandbox
create, start, and Manager boot so passwordless sudo works in the guest.

…uild

…ommand

Pull the configured guest image in the background when the Manager boots and
when sandbox enforcement is switched on, so a sandboxed command no longer
pays the multi-gigabyte download. msb pull is a no-op once cached, startup is
never blocked by it, and a command racing the pull joins the same in-flight
boot.

…enabled

Startup and the enforcement toggle now run the same ensureWorkspaceSandbox
path a command triggers, so the image pull, microVM boot, attestation and
exec-user provisioning are done before the first command instead of on it.
One microVM serves every repo and schedule worktree.

msb caches images by reference and pull without --force never contacts the
registry, while attestation compares the reference string. A floating tag
therefore keeps a stale guest image forever and still passes attestation.
Pinning the default to the published index digest makes IfMissing pull the
new image and forces the running microVM to be recreated on deploy.

…n rebuilt image (#343)

* fix(sandbox): wait for the guest agent before provisioning the exec user

A freshly created microVM does not accept msb exec until its guest agent is
up, so provisioning raced the boot and died on three 15s timeouts, which then
failed the whole enforcement-enable path. Gate provisioning on msb ping
bounded by SANDBOX_START_TIMEOUT_MS, give the exec a 30s budget, and downgrade
a provisioning failure to a warning so a missing sudo entry never blocks
sandboxed commands.

* fix(sandbox): align canonical shell spec with msb and pin the rebuilt guest image

- pass --shell /bin/sh explicitly at create and derive the canonical
  spec from the create args so msb 0.6.15 recordings match attestation
- bump the SANDBOX_IMAGE pin to the rebuilt guest image digest
- verify the provisioned exec user inside the guest and give the
  provisioning exec the full start timeout, bounded by a deadline

* docs(sandbox): sync the image digest pin into the docker and environment docs

* fix(sandbox): verify the guest image as an unknown uid and pin the rebuild

The build verification ran as uid 1000, which is the base image's node user,
so it exercised the known-user path and would have passed even if the numeric
exec uid the runtime actually uses were broken. Verify the toolchain as uid
4242 instead and keep the sudo check on the known user, since sudo refuses
unknown uids by design. Also only write the shadow entry when the passwd entry
is created, so a uid that already exists leaves no orphan record.

* fix(sandbox): close spawned command stdin so msb exec completes

msb exec reads its stdin during session setup and waits for EOF, so
every child spawned through executeCommand with an open stdin pipe hung
until its timeout while identical CLI execs finished instantly. Spawn
children with stdin ignored.

Also verify the provisioned exec user from a fresh guest exec after
each provisioning attempt and move failed provisioning to a logged
background retry bounded by five attempts so a slow guest no longer
blocks enforcement or leaves sudo silently missing.

* test(sandbox): derive expected inspect spec from canonical builders

* fix(sandbox): cancel provisioning retries on stop and serialize attempts

Advance the provisioning retry generation and drop the pending retry at the
start of every managed-sandbox stop, so a retry scheduled before a toggle-off
no longer pings and provisions a stopped sandbox. Clearing the promise as well
keeps later retries schedulable, since the generation guard would otherwise
strand it and short-circuit scheduling.

Route every provisioning caller through a single in-flight promise so the
boot-path attempt and the background retry cannot run the check-then-append
passwd and shadow script concurrently and append duplicate account entries.

* feat(settings): add manager logs viewer with backend log capture

* style(settings): polish logs viewer layout for mobile and full-height output