Add Islo backend for sandbox tools

[zozo123]

Adds a hosted Islo microVM backend for SandboxToolset, giving containerized Airflow workers a production-capable backend without a local daemon or KVM.

What changed

• maps SandboxSpec environment and deny-all/allow-all network policy at creation, rejecting unsupported domain allowlists;
• uses native streaming file transfer and bounds command output inside the microVM;
• destroys timed-out sandboxes and configures a server-side TTL as the orphan-cleanup backstop;
• resolves the optional Islo SDK and Airflow connection lazily; and
• documents the sandbox-islo extra and adds unit plus system coverage.

Validation

• 45 focused unit tests pass with the current SDK and minimum islo==0.3.9;
• the complete system test passed against a real Islo microVM, covering all four tools, persistence, failures, and teardown;
• provider import succeeds without the optional Islo SDK; and
• Ruff, formatting, codespell, provider metadata checks, and relevant pre-commit hooks pass locally.

Related: #68847

---

Was generative AI tooling used to co-author this PR?

• Yes — Codex (GPT-5.6)

Generated-by: Codex (GPT-5.6) following the guidelines