Add OpenSandbox backend for sandbox tools

[zozo123]

Adds a self-hosted OpenSandbox backend for SandboxToolset, so Airflow workers can use a remote Docker or Kubernetes sandbox service without access to the container runtime.

What changed

• maps SandboxSpec environment and network policy at creation, preserving the fail-closed contract;
• streams byte-bounded command output and uses OpenSandbox's native file APIs;
• applies server-side command deadlines and a server-side sandbox lifetime;
• resolves the optional SDK and a generic Airflow connection lazily; and
• documents the sandbox-opensandbox extra and adds unit plus system coverage.

Validation

• 38 focused unit tests pass with the minimum/current opensandbox==0.1.15;
• a real OpenSandbox Docker server test passed with authenticated creation, deny-all egress, all backend operations, output truncation, timeout, and idempotent teardown;
• the Common AI provider wheel builds with the new extra and backend; and
• Ruff, formatting, codespell, YAML/Markdown, provider metadata, dependency, documentation, and system-test hooks pass locally.

Related: #68847

---

Was generative AI tooling used to co-author this PR?

• Yes — Codex (GPT-5.6)

Generated-by: Codex (GPT-5.6) following the guidelines