feat: sandbox interface package

[deevus]

Summary

• Scaffold backend-agnostic sandbox package with Backend, Exec, and NetworkPolicy interfaces composed into Sandbox
• Add value types (Instance, Snapshot, CreateOpts, etc.) replacing direct truenas-go type leaks
• Add Register/Open registry for backend plugin discovery
• 100% test coverage on executable code

TrueNAS backend extraction behind this interface will follow in this same PR.

Ref: #6

Test plan

• go build ./sandbox/... compiles
• go vet ./sandbox/... clean
• go test ./... all existing tests pass
• 100% coverage on sandbox package

🤖 Generated with Claude Code

[github-actions]

⬆️ Go test coverage increased from 25.4% to 47.0% compared to 14e472e

⚠️ 1 of 12 packages have zero coverage.

• github.com/deevus/pixels

Updated Package Coverages:

# Package Name                                |  Prior |    New
+ github.com/deevus/pixels/cmd                |   6.5% |   9.6%
+ github.com/deevus/pixels/internal/provision |  40.6% |  79.1%
+ github.com/deevus/pixels/internal/ssh       |  18.4% |  34.7%
+ github.com/deevus/pixels/internal/truenas   |  43.3% |  83.8%
+ github.com/deevus/pixels/sandbox            |   0.0% | 100.0%
+ github.com/deevus/pixels/sandbox/truenas    |   0.0% |  66.0%

View coverage for all packages

# Package Name                                | Coverage
- github.com/deevus/pixels                    |     0.0%
+ github.com/deevus/pixels/cmd                |     9.6%
+ github.com/deevus/pixels/internal/cache     |    93.8%
+ github.com/deevus/pixels/internal/config    |    94.0%
+ github.com/deevus/pixels/internal/dataset   |   100.0%
+ github.com/deevus/pixels/internal/egress    |    93.5%
+ github.com/deevus/pixels/internal/provision |    79.1%
+ github.com/deevus/pixels/internal/retry     |   100.0%
+ github.com/deevus/pixels/internal/ssh       |    34.7%
+ github.com/deevus/pixels/internal/truenas   |    83.8%
+ github.com/deevus/pixels/sandbox            |   100.0%
+ github.com/deevus/pixels/sandbox/truenas    |    66.0%