Replace custom DockerSandbox with supported Mastra sandboxing and environment configuration

[justsml]

This was generated by AI during triage.

Goal

Fold the custom Kali Docker sandbox behavior into preferred/supported Mastra sandboxing, while retaining ExploitHunter’s Kali image and isolation requirements.

Scope

• Replace, retire, or reduce src/mastra/config/docker-sandbox.ts in favor of the supported Mastra sandbox/provider path.
• Support .env sandbox-provider configuration using meaningful values (provider, image/template, network mode/profile, resources, endpoint/region), without adding custom boolean flags.
• Preserve thread workspace semantics, approved execution, resource limits, offline default, and error visibility.
• Reuse the project-lab hardening/containment seam instead of maintaining a second Docker command builder.

Acceptance criteria

• Docker/custom sandbox behavior no longer bypasses the project lab hardening defaults.
• Provider selection and errors are deterministic and test-covered.
• Existing local development configuration remains explicit and safe by default.

Notes

This issue is being implemented in parallel; reconcile the delivered work and update the ticket with the resulting approach.

[justsml]

This was generated by AI during triage.

Implemented in commit d8c08313 (Replace custom workspace Docker sandbox with Mastra isolation). The custom Docker workspace sandbox was retired in favor of Mastra native LocalSandbox isolation, with WORKSPACE_SANDBOX_PROVIDER and isolation/network/timeout configuration. Kali execution remains in the hardened project-lab/MicroVM seam.

Verified: focused workspace/project-service tests (34 passed) and pnpm typecheck.

Note: the official @mastra/e2b adapter was not added because it is blocked by the repository package maturity policy; remote E2B remains fail-closed until eligible.