feat(server): transport sandbox lifecycle hooks

[jianpingpei]

Summary

• Add the standard CreateSandboxRequest.lifecycle schema for the optional preStart and periodic hooks.
• Validate reserved transport, duplicate periodic names, and unsupported pool allocation combinations.
• Serialize lifecycle configuration into the reserved OPEN_SANDBOX_LIFECYCLE environment variable for Kubernetes workloads so execd can consume it.
• Explicitly reject lifecycle requests on the Docker provider; Docker hook execution remains out of scope.

This is the Server part of OSEP-0020 (#1542). It complements the execd implementation in #1587 and the API Spec/SDK changes in #1588. PATCH and other lifecycle hooks are intentionally out of scope.

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Validated:

• Server Ruff checks passed
• Server full test suite: 1506 passed

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f0ba38d997

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Pangjiping]

Minor: consider aligning the name with the existing reserved env var convention and moving it where the other reserved env constants live.

1. Naming: the other server-managed reserved vars use the OPENSANDBOX_EGRESS_* prefix (no underscore between OPEN and SANDBOX, e.g. OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE), so this would be OPENSANDBOX_LIFECYCLE for consistency.
2. Placement: this is a runtime transport detail, not API schema — consider defining it alongside the other reserved env constants in services/constants.py and importing it here, so all reserved env names live in one place.

Note: renaming also requires syncing the execd side (ConfigEnv in components/execd/pkg/lifecycle/config.go plus the isolation/config.go, initmode_linux.go, and bootstrap.sh references), which is a cross-component change — fine to do as a follow-up if it needs to stay in this PR.