Define Stack integration contracts for sandboxes and CI runners

[halfcyan]

Summary

After the Proxmox-to-Odorobo migration path is established, define the Odorobo API contract that Stack's dashboard, development sandboxes, and CI runner services will utilize.

Scope

• Define sandbox VM profiles and persistent workspace semantics.
• Define ephemeral CI runner lifecycle and secret-handling boundaries.
• Define console and vsock connection information.
• Define asynchronous operation/status responses.
• Publish dashboard-facing request/response structs or OpenAPI artifacts.
• Schedule this after the Proxmox migration work; it is not a prerequisite for migration.

Tasks

• Define sandbox VM profiles and resource defaults.
• Define persistent workspace volume behavior and cleanup rules.
• Define console and vsock connection information for sandbox consumers.
• Define ephemeral CI runner lifecycle and teardown behavior.
• Define secret-handling boundaries for GitHub and other forge runners.
• Define asynchronous operation and status response types.
• Define dashboard-facing VM, volume, node, console, and operation types.
• Publish the Rust structs or generated OpenAPI artifacts.
• Confirm the contract targets the post-migration Odorobo platform rather than compatibility with pre-migration Odorobo APIs.
• Add representative request/response fixtures.

What this should do

• A sandbox can be represented by an Odorobo VM manifest.
• Workspace persistence and cleanup behavior are explicit.
• CI runner secrets are not stored in manifests in plaintext.
• Dashboard-required VM, volume, node, console, and operation types are documented.
• This issue does not implement dashboard UI or forge-specific runner registration.

Dependencies

• Depends on draft issues 03 and 09.

Related issues

• Related to Metadata Service #25 and Generate cloud-init/Ignition configs #26.
• Provides the contract for future sandbox and CI runner implementation issues.

Issue links

• Depends on #100 and #106.
• This is post-migration Stack integration work, not a prerequisite for the Proxmox-to-Odorobo migration in #103.
• Related to existing #25 and #26.