Add header status pill showing task/session/sandbox state

Surface aggregate status (error, provisioning, running, ready, no sandbox)
as a colored pill in the transcript panel header. Integrates task runtime
status, session status, and sandbox availability via the sandboxProcesses
interest topic so the pill accurately reflects unreachable sandboxes.

Includes mock tasks demonstrating error, provisioning, and running states,
unit tests for deriveHeaderStatus, and workspace-dashboard integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

foundry/packages/backend/src/sandbox-config.ts

@@ -0,0 +1,39 @@
+import type { AppConfig, ProviderId } from "@sandbox-agent/foundry-shared";
+
+function hasE2BApiKey(config: AppConfig): boolean {
+  return Boolean(config.providers.e2b.apiKey?.trim());
+}
+
+function forcedSandboxProviderId(): ProviderId | null {
+  const raw = process.env.FOUNDRY_SANDBOX_PROVIDER?.trim() ?? process.env.HF_SANDBOX_PROVIDER?.trim() ?? null;
+  if (raw === "local" || raw === "e2b") {
+    return raw;
+  }
+  return null;
+}
+
+export function defaultSandboxProviderId(config: AppConfig): ProviderId {
+  const forced = forcedSandboxProviderId();
+  if (forced === "local") {
+    return "local";
+  }
+  if (forced === "e2b") {
+    if (!hasE2BApiKey(config)) {
+      throw new Error("FOUNDRY_SANDBOX_PROVIDER=e2b requires E2B_API_KEY to be configured.");
+    }
+    return "e2b";
+  }
+  return hasE2BApiKey(config) ? "e2b" : "local";
+}
+
+export function availableSandboxProviderIds(config: AppConfig): ProviderId[] {
+  return hasE2BApiKey(config) ? ["e2b", "local"] : ["local"];
+}
+
+export function resolveSandboxProviderId(config: AppConfig, requested?: ProviderId | null): ProviderId {
+  if (requested === "e2b" && !hasE2BApiKey(config)) {
+    throw new Error("E2B provider is not configured. Set E2B_API_KEY before selecting the e2b provider.");
+  }
+
+  return requested ?? defaultSandboxProviderId(config);
+}