fix(eve)!: make the Upstash Box sandbox backend actually usable

[CahidArda]

Summary

Three fixes to the eve upstash() sandbox backend (@upstash/agentkit-eve/sandbox),
prompted by running a real agent against Upstash Box ("write a node script that
prints hello world"). The backend type-checked but misbehaved at runtime:
config knobs that didn't map to Box, a stale snapshot that was never reused, the
wrong working directory, and a new box created on every session open.

Scoped to the eve sandbox; folded into the pending harden-tenant-isolation
changeset (no new changeset).

1. Config is Box's BoxConfig, verbatim (breaking)

UpstashBackendConfig invented Vercel-shaped knobs (resources.vcpus, runtime
strings like "node24", an Eve-shaped networkPolicy) that didn't correspond to
anything in Upstash Box.

• Now Omit<BoxConfig, "networkPolicy"> & { redis?, templatePrefix? } — pass
  runtime / size / apiKey / keepAlive / initCommand / env / skills /
  … exactly as you would to Box.create({...}).
• Removed resources.vcpus → size mapping and runtime-string coercion.
• networkPolicy is no longer a config knob: egress is deny-all by default
  (enforced at creation) and opened only per-session via use({ networkPolicy }).

2. Prewarmed template snapshots are actually reused

prewarm (build/startup) recorded the templateKey → snapshotId mapping in an
in-memory map, which create (per request, a different process) couldn't see —
so it always built a fresh, empty box and the seed files never reached the agent.

• The mapping now lives in a durable Redis registry (redis defaults to
  Redis.fromEnv()). Box has no static snapshot lookup, so this is what bridges
  prewarm → create across processes (the same role Vercel's named sandbox plays).
• prewarm builds no box at all when there's nothing to bake.

3. One box per conversation, not one per session-open

The agent's logs showed three opening sandbox session per turn — a new box each
time. create ignored existingMetadata, and dispose called box.pause(),
which throws for keep-alive boxes.

• create reattaches to existingMetadata.boxId (Box.get) before falling back
  to the template snapshot / a fresh box. Eve hands back the id we record in
  captureState, so the conversation keeps a single box.
• dispose is a no-op (matching Eve's Vercel backend) so the box survives for the
  next open to reattach.
• keepAlive now defaults to false (Box's pause-based idle lifecycle), so the
  no-op dispose doesn't leak — idle boxes auto-pause and are reaped.

4. /workspace → /workspace/home path bridge

Eve roots its tools at /workspace (hardcoded in its glob/grep tools, e.g.
find /workspace …), but a Box session lives in /workspace/home and /workspace
itself is permission-denied — so file ops and find hit the wrong directory.

• The backend bridges the two in resolvePath (file ops) and in raw commands
  (toBoxPath / rewriteWorkspacePaths).
• The command rewrite is URL-safe (lookbehind): curl host/workspace/x is left
  alone; only genuine /workspace path tokens are mapped.
• Known limitation (documented): /workspace hardcoded inside a file the model
  writes then executes isn't rewritten — inherent to Box making /workspace
  off-limits, mitigated because the model sees real /workspace/home paths in
  tool output.

Testing

• Live Upstash Box (+ Redis) tests: create/run/file round-trip, box reuse across
  opens via existingMetadata, deny-by-default egress + per-session open, and
  cross-instance snapshot reuse via the Redis registry. Live tests delete boxes
  explicitly now that dispose is a no-op.
• Offline unit tests for the path bridge (toBoxPath, rewriteWorkspacePaths,
  incl. the URL-safety cases).
• pnpm typecheck / lint clean.