fix(agents/orb): use standard SandboxAgent client for AgentOS sandbox

The in-process DockerSandboxClient could never satisfy AgentOS 0.2.10's
sandbox serialization contract: AgentOS serializes sandbox mounts through
getSerializableClientConfig, which reads client.baseUrl and passes it to the
sidecar. An in-process object has no network endpoint.

Replace the custom adapter with the supported boundary: SandboxAgent.start
with sandbox-agent/docker, which starts a sandbox-agent server inside a
Docker container with a dynamically mapped host port and returns a
SandboxAgent client whose baseUrl both the main process and the sidecar
subprocess reach over 127.0.0.1. Dispose calls destroySandbox so no
containers are left behind.

Remove 700+ lines of dead DockerSandboxClient infrastructure (PID tracking,
log files, signal handling) now handled natively by the sandbox-agent
server. Add a sqlite_file database descriptor to AgentOs.create so session
storage works. Wrap command execution in sh -c for the SandboxAgent API.
Apply chmod 600 to the real OpenCode config path containing the gateway key.

The real proof with the main .env now passes all three stages:
ORB_STAGE_DOCKER_OK, ORB_STAGE_AGENTOS_OK, ORB_STAGE_MODEL_TURN_OK,
ending ORB_PROOF_PASSED with zero leftover containers.

Update README to describe the real SandboxAgent + Docker topology and
remove the misleading 'missing sidecar' limitation.

packages/agents/package.json

@@ -12,21 +12,25 @@
     "run:zopu": "bun --env-file=../../.env flue run zopu"
   },
   "dependencies": {
+    "@agentos-software/opencode": "0.2.7",
     "@code/backend": "workspace:*",
     "@code/env": "workspace:*",
     "@code/primitives": "workspace:*",
     "@flue/runtime": "latest",
     "@rivet-dev/agentos-core": "catalog:",
     "convex": "catalog:",
+    "dockerode": "^5.0.1",
     "effect": "catalog:",
+    "get-port": "^7.2.0",
     "hono": "4.12.31",
-    "valibot": "^1.4.2",
-    "@agentos-software/opencode": "0.2.7"
+    "sandbox-agent": "0.4.2",
+    "valibot": "^1.4.2"
   },
   "devDependencies": {
     "@code/config": "workspace:*",
     "@flue/cli": "latest",
     "@types/bun": "catalog:",
+    "@types/dockerode": "^4.0.1",
     "typescript": "catalog:"
   }
 }