feat: snapshot/restore checkpoints (SAND-WP-0007)

Add workspace checkpoint API with SnapshotStore, extension hooks on
compose-ssh and saas-stub, manager orchestration, CLI/HTTP surface,
profile.compose-checkpoint, and docs/tests.

src/sandboxer/extensions/base.py

@@ -45,4 +45,22 @@ class SandboxExtension(ABC):
 
     def meter_actual(self, handle: dict[str, str], *, duration_s: float) -> float | None:
         """Optional post-destroy actual cost in USD."""
-        return None
+        return None
+
+    def supports_snapshots(self) -> bool:
+        """Whether this extension implements checkpoint snapshot/restore."""
+        return False
+
+    def snapshot(self, handle: dict[str, str]) -> dict[str, str]:
+        """Capture workspace checkpoint. Returns snapshot metadata including snapshot_id."""
+        raise NotImplementedError(f"{type(self).__name__} does not support snapshots")
+
+    def restore_from_snapshot(
+        self,
+        profile: Profile,
+        snapshot_meta: dict[str, str],
+        inputs: dict[str, str],
+        host: str,
+    ) -> dict[str, str]:
+        """Provision a new sandbox from a prior checkpoint."""
+        raise NotImplementedError(f"{type(self).__name__} does not support restore")