Extract host sandbox runner services

[chubes4]

Summary

• Split WP_Codebox_Agent_Sandbox_Runner host adapter concerns into focused services for parent request normalization, sandbox recipe building, tool policy validation, run result normalization, and bounded parent-site seed export.
• Keep the runner public behavior and smoke-test seams intact by delegating existing methods through the new services.
• Preserve canonical-only request/component contracts from Remove legacy task input aliases #805/Make WP Codebox component adapters generic #806; no legacy adapter fields or path aliases are reintroduced.

Fixes #769.

Checks

• php -l packages/wordpress-plugin/src/class-wp-codebox-agent-sandbox-runner.php && php -l packages/wordpress-plugin/src/class-wp-codebox-host-request-normalizer.php && php -l packages/wordpress-plugin/src/class-wp-codebox-host-tool-policy-validator.php && php -l packages/wordpress-plugin/src/class-wp-codebox-host-recipe-builder.php && php -l packages/wordpress-plugin/src/class-wp-codebox-host-run-result-normalizer.php && php -l packages/wordpress-plugin/src/class-wp-codebox-parent-site-seed-exporter.php && php -l packages/wordpress-plugin/wp-codebox.php
• php -l tests/smoke-wordpress-plugin.php && php tests/smoke-wordpress-plugin.php
• npm run build
• npm run smoke -- --group=policy
• npm run smoke -- --group=agent
• git diff --check

Notes

• npm run wordpress-plugin-smoke is not currently a root package script on origin/main; the equivalent manifest command ran through npm run smoke -- --group=policy and passed (wordpress-plugin-smoke -> php tests/smoke-wordpress-plugin.php).
• A focused source grep found no reintroduced legacy adapter/path identifiers removed by Remove legacy task input aliases #805/Make WP Codebox component adapters generic #806: homeboy/wp-codebox, wp_codebox_component_paths, agents_api_path, data_machine_path, data_machine_code_path, runtime_component_paths, legacy_component, or wp_codebox_enable_legacy.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (openai/gpt-5.5)
• Used for: Drafting and implementing the host runner service extraction, updating smoke bootstrap coverage, checking legacy identifier regressions, and running local verification. Chris remains responsible for review and merge.