feat: snapshot/restore checkpoints (SAND-WP-0007)

Add workspace checkpoint API with SnapshotStore, extension hooks on
compose-ssh and saas-stub, manager orchestration, CLI/HTTP surface,
profile.compose-checkpoint, and docs/tests.

workplans/SAND-WP-0007-snapshot-restore.md

@@ -0,0 +1,85 @@
+---
+id: SAND-WP-0007
+type: workplan
+title: "Snapshot restore and checkpoint profiles"
+domain: infotech
+repo: sand-boxer
+status: finished
+owner: codex
+topic_slug: custodian
+created: "2026-06-24"
+updated: "2026-06-24"
+---
+
+# Snapshot restore and checkpoint profiles
+
+Workspace checkpoint API for self-hosted compose sandboxes and SaaS stub.
+
+**Predecessor:** SAND-WP-0006 (SaaS extensions — finished)  
+**Follow-on:** TTL enforcement, cross-host snapshot transfer, E2B/Modal persistence
+
+## Snapshot store and models
+
+```task
+id: SAND-WP-0007-T01
+status: done
+priority: high
+```
+
+`SnapshotRecord`, `SnapshotStore` at `~/.local/share/sandboxer/snapshots.json`.
+
+## Extension hooks
+
+```task
+id: SAND-WP-0007-T02
+status: done
+priority: high
+```
+
+Optional `supports_snapshots`, `snapshot`, `restore_from_snapshot` on
+`SandboxExtension`. Reference: `ext.compose-ssh` (remote tar), `ext.saas-stub`
+(metadata stub).
+
+## Manager orchestration
+
+```task
+id: SAND-WP-0007-T03
+status: done
+priority: high
+```
+
+`SandboxManager.snapshot`, `restore`, `list_snapshots`, `get_snapshot`. Restore
+provisions a new sandbox; source sandbox stays ready.
+
+## CLI and HTTP API
+
+```task
+id: SAND-WP-0007-T04
+status: done
+priority: high
+```
+
+CLI: `snapshot`, `restore`, `snapshots list|get`. HTTP:
+`POST /v1/sandboxes/{id}/snapshot`, `POST /v1/snapshots/{id}/restore`,
+`GET /v1/snapshots`.
+
+## Profile and docs
+
+```task
+id: SAND-WP-0007-T05
+status: done
+priority: medium
+```
+
+`profile.compose-checkpoint`, `docs/snapshots.md`, updates to `extension-sdk.md`,
+`meta-framework.md`, `SCOPE.md`.
+
+## Tests
+
+```task
+id: SAND-WP-0007-T06
+status: done
+priority: high
+```
+
+`tests/test_snapshots.py`, compose-ssh snapshot tests, API stubs, manager flow.