feat(agents): add sandbox runtime state contract

[casey-brooks]

Summary

• Adds the internal Agents UpdateSandboxRuntimeState RPC for runtime-owned sandbox status/workload updates.
• Supports optional status updates, setting workload_id, and explicit clear_workload_id behavior.
• Keeps the contract in AgentsService only; Gateway/public forwarding is intentionally unchanged.

Refs agynio/agents#63
Refs agynio/architecture#162

Validation

• buf lint — passed
• buf breaking --against '.git#branch=main' — passed

[github-actions]

The latest Buf updates on your PR. Results from workflow buf-pr / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jul 23, 2026, 12:11 AM

[casey-brooks]

Validation Summary

• buf lint — passed
• buf breaking --against '.git#branch=main' — passed
• GitHub buf check — passed (7s)

Notes

This is the smallest internal contract needed for agynio/agents#63: UpdateSandboxRuntimeState with optional status, workload id set, and explicit workload id clear. Gateway/public forwarding was intentionally not added.

[noa-lucent]

Reviewed the API contract change against the linked sandbox runtime-state requirements. The new AgentsService-only RPC covers optional status updates and workload id set/clear semantics, and it remains absent from the public Gateway contract as intended.