Add DenoSandboxExecutor (Deno + Pyodide) + tool middleware plumbing

[xpcmdshell]

Summary

• Adds DenoSandboxExecutor (backend key: deno-sandbox) running Python in Pyodide (WASM) inside a Deno subprocess.
• Preserves sync-by-default agent ergonomics for existing executors; Deno sandbox is async-first (await tools/workflows/artifacts/deps).
• Implements chunked host<->sandbox RPC to support large tool outputs.

Security model

• Python execution is sandboxed (Deno permission model + Pyodide runtime).
• tools.* execute host-side: sandbox tool calls are proxied back to the host and run via existing ToolAdapters.

Tool middleware plumbing (Deno-supported first)

• Adds generic tool middleware interfaces (ToolCallContext, ToolMiddleware) and an adapter wrapper.
• ToolRegistry.apply_tool_middlewares(...) applies middleware without stacking and also enforces middleware for adapters registered later.
• DenoSandboxConfig.tool_middlewares wires middleware into the Deno sandbox host-side tool path.

Docs / Examples

• Docs updated to clarify tool execution boundary and middleware hook.
• Adds new example: examples/deno-sandbox/.

Tests

• Adds unit tests for middleware plumbing.
• Deno integration tests live in tests/test_deno_sandbox_executor.py and are executed in CI via the test-deno-sandbox job.
• Adds pytest marker definitions (e.g. slow, integration, docker) and auto-marks xdist groups to make it easier to run subsets.

How to test locally

• uv run pytest
• Skip docker-heavy tests: uv run pytest -m "not docker"
• Deno integration: PY_CODE_MODE_TEST_DENO=1 uv run pytest -n 0 tests/test_deno_sandbox_imports.py tests/test_deno_sandbox_executor.py -v