feat: add Harbor Daytona sandbox backend

[nmogil]

Closes #8

Summary

• add explicit Harbor-managed Daytona sandbox selection alongside local Docker
• pin Harbor 0.18.0, Daytona SDK 0.196.0, immutable sandbox image digests, and in-sandbox Pi 0.80.6
• validate provider-returned CPU/RAM/disk/network state instead of treating requested config as effective state
• keep hidden verifier network-disabled and free of model secrets
• bind policy and cleanup receipts to exact attempt/session/sandbox identities
• add race-safe deletion confirmation and an expired managed-sandbox reaper
• preserve Docker evidence compatibility while exposing only isolated-sandbox to blinded consumers
• add provider conformance, degradation, leakage, canary, and cleanup tests

Verification

• .venv/bin/pytest -q — 99 passed, 1 manually gated skip
• .venv/bin/ruff check . — passed
• .venv/bin/mypy src — passed
• .venv/bin/pytest -q -m docker_smoke tests/test_harbor_docker_smoke.py — passed
• fresh isolated pip check for .[daytona] — passed; Harbor 0.18.0 / Daytona 0.196.0
• git diff --check — passed
• static reviewer contract consumed byte-for-byte by the companion BlindBench PR

Live-smoke gate

No Daytona credential was available in the implementation environment. The live fictional smoke remains manually gated and was not claimed as successful. It validates provider-effective policy, runtime pins, cleanup, retained-artifact credentials, and hidden-verifier canary absence when credentials and an immutable image digest are supplied.

Boundaries

No customer/private fixtures, paid model matrix, host-side Daytona Pi extension, direct non-Harbor execution path, deployment, or model training.