Implement SAND-WP-0002 meta-framework foundation (T01–T09)

Add meta-framework spec, pydantic schemas, profile/extension YAML, extension
registry, ext.compose-ssh backend, SandboxManager with State Hub events, CLI
commands, integration docs, capability registry entry, and compose-e2e runbook.
Nine unit tests pass. T10 remote smoke test remains for operator.

docs/integrations/snuggle-inventor.md

@@ -0,0 +1,37 @@
+# snuggle-inventor integration
+
+snuggle-inventor owns code generation and modernization workflows. sand-boxer
+provides a build sandbox with setup metadata resolved at the provision boundary.
+
+## Example request
+
+```bash
+sandboxer create \
+  --profile profile.build \
+  --input repo=/path/to/target \
+  --actor agt \
+  --project snuggle-inventor
+```
+
+## Response fields (ready state)
+
+| Field | Owner | Description |
+|-------|-------|-------------|
+| `sandbox_id` | sand-boxer | Build environment instance |
+| `reachability.ssh` | sand-boxer | Remote workspace access |
+| `profile.setup.secret_refs` | sand-boxer resolves | Secrets never returned to agent context |
+
+## Ownership
+
+| Concern | Owner |
+|---------|-------|
+| Sandbox provision and teardown | sand-boxer |
+| Setup instructions content (Blitzy-style) | snuggle-inventor |
+| Generated code and PR output | snuggle-inventor |
+| Secret resolution at boundary | sand-boxer (via ops-warden / OpenBao) |
+
+## Out of scope for sand-boxer
+
+- Code generation prompts and tech specs
+- AAP-style planning
+- PR creation and review loops