* feat: add ISLO microVM sandbox environment (--env islo)

Add ISLO as a new environment provider for Harbor, enabling agent
evaluation in lightweight microVM sandboxes via the islo SDK.

Supports three modes:
- Pre-built Docker image (docker_image config)
- Dockerfile build via Docker-in-VM
- Plain islo-runner sandbox (fallback)

Includes full unit test coverage for lifecycle, exec routing,
Docker-in-VM build, file transfer, and attach.

* fix(islo): add user parameter to exec() to match updated base class API

BaseEnvironment.exec() now accepts a `user` parameter. Thread it through
IsloEnvironment.exec() → _docker_exec() (via `docker exec -u`) and accept
it in _sandbox_exec() for API consistency (bare sandbox always runs as root).

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(islo): increase Docker lifecycle timeouts

Extract hardcoded infrastructure timeouts to named constants and increase
them to safer values, preventing spurious failures under I/O pressure or
during parallel benchmark runs.

- docker run: 30s → 120s
- docker cleanup: 30s → 60s
- docker stop: 15s → 30s

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(islo): pass platform env vars to Docker containers for TLS trust

The transparent proxy in Islo sandboxes uses MITM certificates for TLS
interception. While the CA bundle is mounted into Docker containers,
Node.js and some other tools don't use the system CA store.

Add platform environment variables to docker run:
- NODE_EXTRA_CA_CERTS: Required for Node.js (e.g., Claude Code installer)
- SSL_CERT_FILE: Used by curl, Python requests, rustls-based tools
- LANG/LC_ALL: Unicode locale for proper output rendering

Fixes ISL-348: Claude Code install fails in swebench with certificate error

Co-Authored-By: Claude Opus 4.5 <[email protected]>

* fix(islo): add REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE to Docker platform env

Docker-in-VM containers need these env vars for Python requests/urllib3
and libcurl to trust the transparent proxy CA certificate.

Made-with: Cursor

* fix(islo): remove redundant CURL_CA_BUNDLE from Docker platform env

curl/libcurl already respects SSL_CERT_FILE which is already set.
CURL_CA_BUNDLE is unnecessary.

Made-with: Cursor

* fix(islo): address PR review feedback — user param, disk calc, log levels

Forward the user parameter to _sandbox_exec in direct sandbox mode and
wrap commands with su (matching Daytona/Runloop pattern).  Fix disk size
conversion to use // 1024 for consistency with other environments.
Downgrade logger.info to logger.debug for routine operational messages.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(islo): lazy-import dockerfile_parse to avoid ImportError for users without it

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(islo): reset _sandbox_name in stop() to clear stale state

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(islo): honor task_env_config.workdir as cwd fallback in exec()

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(islo): two-hop file transfer in Docker-in-VM mode

In DinD mode, exec() runs inside the Docker container while the islo
SDK transfers files to the sandbox filesystem. Only /logs, /tests,
/solution are bind-mounted, so uploads/downloads to other container
paths were silently invisible to exec.

Public file-transfer methods now dispatch: direct SDK when no Docker
container (or when the path is volume-mounted), two-hop via docker cp
otherwise. Matches the pattern in Daytona (_DaytonaDinD) and Modal
(_ModalDinD).

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(islo): move islo SDK to optional extra, add to cloud group

islo requires an external Python SDK like modal/daytona/e2b do,
so it belongs in [project.optional-dependencies] rather than base
dependencies. Set pip_extra="islo" in the factory so users get a
helpful install hint if the import fails.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(islo): add dockerfile-parse to islo extra

dockerfile_parse is used at __init__ time when a Dockerfile is
present, making it a real dependency for Dockerfile-based tasks.
Matches the e2b extra which bundles it for the same reason.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

---------

Co-authored-by: islo <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: Assaf Ben Josef <[email protected]>