SDK sandbox provisioning: built-in providers, docs restructure, and quickstart overhaul

- Add built-in sandbox providers (local, docker, e2b, daytona, vercel, cloudflare) to the TypeScript SDK so users import directly instead of passing client instances
- Restructure docs: rename architecture to orchestration-architecture, add new architecture page for server overview, improve getting started flow
- Rewrite quickstart to be TypeScript-first with provider CodeGroup and custom provider accordion
- Update all examples to use new provider APIs
- Update persist drivers and foundry for new SDK surface

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/security.mdx

@@ -4,7 +4,7 @@ description: "Backend-first auth and access control patterns."
 icon: "shield"
 ---
 
-As covered in [Architecture](/architecture), run the Sandbox Agent client on your backend, not in the browser.
+As covered in [Orchestration Architecture](/orchestration-architecture), run the Sandbox Agent client on your backend, not in the browser.
 
 This keeps sandbox credentials private and gives you one place for authz, rate limiting, and audit logging.
 
@@ -92,7 +92,7 @@ export const workspace = actor({
 
       const session = await sdk.createSession({
         agent: "claude",
-        sessionInit: { cwd: "/workspace" },
+        cwd: "/workspace",
       });
 
       session.onEvent((event) => {