Triage: adrs: boxd as an agent-computer substrate

[time-attack]

Tracking the change proposed in #718 (by @MichielMAnalytics).

We're moving this from a code PR to a tracked issue under CONTRIBUTING.md: feature ideas belong in adrs/ as a short human-written note and bugs as an issue, and we implement the underlying code from our side. Capturing the original proposal here so it isn't lost.

Original PR: #718
Reported by: @MichielMAnalytics

---

adrs/boxd-sandbox.md is Michiel's (co-founder, boxd.sh) own words, per CONTRIBUTING.md. The implementation is included in this PR as the two commits after it, so it can be merged as-is or pulled apart if you'd rather implement it your way.

What it adds

• SANDBOX_BACKEND=boxd: a durable per-scope agent computer on boxd microVMs via @boxd-sh/sdk (gRPC). Resident disk, process sessions, backup and blob staging through the existing exec helpers. Machines are addressed by id; reads above the 4 MiB gRPC cap are chunked; stopped machines are started, suspended/hibernated ones wake on exec.
• "sandbox": { "backend": "boxd" } as a first-class deploy-config value on docker, fly and aws: validation, check, the secrets catalog (BOXD_API_KEY), env rendering and sandbox publish all know it.
• npm run smoke:boxd-sandbox (live), dev instance --sandbox boxd.

Verification: 27 backend unit tests against an in-process fake; CLI suite 529/529; full root suite green; typecheck/eslint/oxlint/knip clean; live smoke against production boxd; real claude-opus-5 turns through qm's orchestrator (execute/write/read on a boxd VM). Details are in the commit messages.

🤖 Generated with Claude Code

https://claude.ai/code/session_018SM8fz3TWnQCXXGEwDpHA4

---

If we ship a fix or feature from this, credit @MichielMAnalytics as co-author.