Implement SAND-WP-0005: extension SDK and ext.vm-packer

Add SandboxExtension base class, extension SDK docs, vm-packer attach mode
for build-machines VMs, profile.vm-haskell-build, SSH port support, tests,
and migration docs.

src/sandboxer/extensions/base.py

@@ -0,0 +1,34 @@
+"""Extension author SDK — base contract for sandbox backends."""
+
+from __future__ import annotations
+
+import uuid
+from abc import ABC, abstractmethod
+from typing import Any
+
+from sandboxer.models import Profile
+
+
+class SandboxExtension(ABC):
+    """Base class for self-hosted and SaaS sandbox extensions."""
+
+    def __init__(self, config: dict[str, Any] | None = None) -> None:
+        self.config: dict[str, Any] = config or {}
+
+    @staticmethod
+    def new_sandbox_id(inputs: dict[str, str]) -> str:
+        return inputs.get("sandbox_id") or str(uuid.uuid4())[:8]
+
+    @abstractmethod
+    def provision(
+        self, profile: Profile, inputs: dict[str, str], host: str
+    ) -> dict[str, str]:
+        """Create or attach sandbox resources. Returns a handle dict for later ops."""
+
+    @abstractmethod
+    def wait_ready(self, handle: dict[str, str]) -> dict[str, str]:
+        """Confirm reachability. Returns reachability descriptor fields."""
+
+    @abstractmethod
+    def teardown(self, handle: dict[str, str]) -> dict[str, str]:
+        """Release sandbox resources. Returns cleanup report fields."""