docs: SandboxTransport remote-exec design (language-neutral gRPC)

[pdettori]

What

Design spec (docs only — no code) for a pluggable SandboxTransport seam between the
harness and the sandbox, so sandboxes can run outside the harness's cluster (self-hosted /
laptop / on-prem / other cloud / bring-your-own). The sandbox dials out; the harness
never reaches in.

Spec: docs/specs/2026-07-08-sandbox-transport-grpc-design.md

Update (why this PR changed)

This PR originally proposed a Redis-Streams transport (a per-sandbox sbx:<id>:req|res
channel served by a TS @sh/sandbox-worker). After further brainstorming we revised the
design. The Redis approach got the direction right — invert connectivity so the sandbox
dials out — but pinned down two things that limit reach and portability:

1. Language lock-in. The contract was a TypeScript interface with JSON+base64 frames, so
   a worker had to be TS (or hand-reimplement the frames). This can't meet the
   heterogeneity / any-language-BYO driver.
2. Redis as the wire. Redis on its port is commonly blocked by egress firewalls that
   allow only :443, and it forces a Redis availability dependency into the exec path.

The revised design keeps the outbound-dial insight and the frame semantics verbatim
(req_id correlation, at-least-once + dedup, dual-ended timeout, per-exec output cap), and
changes only the encoding and transport.

Revised approach

• Contract = Protobuf IDL (sandbox/v1); any language with gRPC codegen can host a
  worker. TS becomes just one generated client.
• gRPC-native, HTTP/2 over TLS :443 — one full-duplex Attach bidi stream the worker
  opens outbound; commands come down the response half. Firewall-friendly, no inbound rules.
  (Connect's HTTP/1.1 fallback was rejected — full-duplex bidi needs HTTP/2 regardless.)
• Single-replica, presence-only relay in-cluster: bridges the worker's Attach stream
  to the harness's in-cluster SandboxExec calls, and mirrors connected workers into the
  existing Redis sandbox pool. No HA, no presence glue, no matching logic in the relay.
• Matching stays in the existing pool / select-sandbox — a remote sandbox is just
  another pool entry that resolves to a GrpcRelayTransport instead of a KubectlTransport.
• One reference worker, in Go — a single static binary, droppable into any image; the
  honest proof the contract is language-neutral.
• Per-sandbox bearer token at the relay edge; SPIFFE/mTLS for untrusted BYO upgrades into
  the same endpoint later.

Kept vs dropped

• Kept from the original: the SandboxTransport interface + KubectlTransport rename (a
  pure, behavior-preserving refactor) and all frame semantics.
• Dropped: RedisChannelTransport and the TS @sh/sandbox-worker are not built;
  Redis returns to being only the pool/session/leaf-queue substrate, never the exec wire.

Deferred (explicit non-goals)

Untrusted-BYO SPIFFE/mTLS · multi-replica relay HA · private-mesh reachability
(Headscale/WireGuard) · additional-language workers · HTTP/1.1-only proxy traversal — all
additive behind the same seam.

Housekeeping

The spec was relocated from docs/superpowers/specs/ to docs/specs/ (the canonical
location where all other specs live); the old Redis spec file is removed in this update.

Assisted-By: Claude Code