feat: migrate E2B sandbox calls to Compute SDK

[dylsteck]

Summary

• Migrates Ship's E2B sandbox lifecycle and command callsites from @e2b/code-interpreter to Compute SDK via @computesdk/e2b.
• Keeps E2B as the provider with template n1exdf9kj7gpwk6810c9, using Compute create options (templateId, timeout, envs, metadata, lifecycle).
• Adds provider/command helper boundaries for lifecycle, native E2B escape hatches, timeout-preserving command execution, terminal PTY access, desktop URLs, and @ship/sandbox.
• Adds focused tests for create option mapping, missing sandbox handling, desktop URL/command behavior, command option mapping, and sandbox adapter URL/Dirent behavior.

Linear: https://linear.app/stecknologies/issue/STE-112/move-from-raw-e2b-sdk-to-compute-sdk-to-support-more-providers

Validation

• pnpm install --frozen-lockfile
• pnpm test
• pnpm lint
• pnpm typecheck
• pnpm openapi:check
• pnpm sdk:generate:check
• pnpm build
• Focused post-review checks:
  • pnpm --filter api typecheck
  • pnpm --filter api test
  • pnpm --filter @ship/sandbox typecheck
  • pnpm --filter @ship/sandbox test
• Search gates:
  • rg -n "@e2b/code-interpreter" apps/api packages/sandbox pnpm-lock.yaml || true
  • rg -n "Sandbox\\.connect|betaCreate|Sandbox\\.kill|getHost\\(|https://\\$\\{.*getUrl|envs: .*runCommand" apps/api packages/sandbox -g '!src/generated/acp-bridge-bundled.ts' || true
  • git diff --check

No browser testing performed per the ticket plan.

Note: local commands warn that this shell is on Node v25.2.1 while the repo requests Node 22.x; the warning did not fail validation.

Sub-Agent Review

• Read-only E2B/Compute API reviewer checked provider semantics, timeout behavior, getById() null/error handling, and native escape hatches.
• Read-only missed-callsites/type-leak reviewer checked raw SDK imports, stale command option names, terminal/desktop paths, and @ship/sandbox adapter behavior.
• Concrete findings were addressed before commit, including lifecycle.onTimeout, error-preserving connect/destroy, and command helper fallback behavior.

Future Providers

The current provider boundary is concentrated in apps/api/src/lib/compute-provider.ts, apps/api/src/lib/sandbox-command.ts, and packages/sandbox/src/e2b.ts. To add another Compute provider later, the likely shape is:

• Install the provider package and add a provider factory next to compute-provider.ts.
• Map Ship's create inputs (templateId or equivalent image/snapshot id, timeout, envs, metadata, pause/kill lifecycle) into that provider's supported options.
• Implement or adapt URL, command, and filesystem behavior for the provider.
• Replace the remaining E2B-native escape hatches: PTY terminal support, explicit pause, timeout refresh, error-preserving connect/destroy, and timeout-preserving command execution.

@computesdk/e2b can fall back to E2B_API_KEY from process.env in Node, but Worker code still passes env.E2B_API_KEY explicitly because Cloudflare secrets arrive as Worker bindings rather than ordinary process.env.