feat(sandbox): allow Docker sandboxes to disable networking - #4452

Summary

This pull request adds an opt-in way to create Docker sandboxes with networking completely disabled.

DockerSandboxClientOptions now accepts:

DockerSandboxClientOptions(
    image="python:3.14-slim",
    network_mode="none",
)

The new option is deliberately narrow:

network_mode: Literal["none"] | None = None

When omitted, Docker container creation remains unchanged and no network_mode argument is passed.

When set to "none", the value is forwarded to docker_client.containers.create(), causing Docker to create the sandbox without networking.

The setting is also persisted in DockerSandboxSessionState and reapplied when DockerSandboxClient.resume() needs to recreate a missing container. This prevents a sandbox originally created without networking from silently regaining Docker's default network configuration after recreation.

Older serialized session states remain compatible because the new field defaults to None.

The public option intentionally does not expose arbitrary Docker networking modes such as host, bridge, or container:<id>.

Test plan

Added regression coverage for:

• accepting network_mode="none"
• rejecting unsupported network modes
• propagating "none" through the public DockerSandboxClient.create() path
• passing network_mode="none" to Docker container creation
• preserving the existing Docker create kwargs when the option is omitted
• DockerSandboxClientOptions serialization and parsing
• DockerSandboxSessionState serialization
• backwards compatibility with serialized states that do not contain network_mode
• reapplying network_mode="none" when resume() recreates a missing container
• compatibility guards for the extended public options/state fields

Focused sandbox tests passed:

86 passed

Full repository verification was run with:

env UV_DEFAULT_INDEX=https://pypi.org/simple \
  bash .agents/skills/code-change-verification/scripts/run.sh

All verification steps passed, including:

• formatting
• lint
• type checking
• full test suite

Issue number

Closes #4451

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed all verification steps pass
• If using Codex, I've run /review before submitting this PR (not applicable; this change was not prepared with Codex)