feat(sandbox): validate OpenSandbox provider_options via a frozen dataclass

[ananthsub]

Summary

Stacked on top of #1712. Addresses the open review thread on #1377 (here) asking whether the individual provider options should be frozen dataclasses so the supported options + validation are discoverable.

Represents the recognized per-sandbox create options (SandboxSpec.provider_options) as a frozen OpenSandboxProviderOptions dataclass with a validating from_mapping:

• Supported options and their types now live in one place (platform, snapshot_id, volumes, skip_health_check, extensions).
• Unknown keys and wrong types are rejected with clear errors.
• The create path reads typed attributes instead of scattered provider_options.get(...) lookups, replacing the ad-hoc _spec_extensions / _provider_option_bool / _spec_volumes helpers.

Design note

SDK-owned nested structures (platform, volumes) are kept as pass-through mappings rather than strictly-typed sub-dataclasses, so their inner fields stay validated by the OpenSandbox SDK and we don't over-constrain options we don't own.

Refs #1377

Test plan

• uv run pytest tests/unit_tests/test_opensandbox_provider.py tests/unit_tests/test_sandbox.py responses_api_agents/mini_swe_agent_2/tests/test_app.py (40 passed, 11 skipped)
• uv run ruff check + ruff format --check clean
• Create-path behavior (platform passthrough, image-pull-policy extensions, skip_health_check) preserved under the fake-SDK tests

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.