Implement SAND-WP-0002 meta-framework foundation (T01–T09)

Add meta-framework spec, pydantic schemas, profile/extension YAML, extension
registry, ext.compose-ssh backend, SandboxManager with State Hub events, CLI
commands, integration docs, capability registry entry, and compose-e2e runbook.
Nine unit tests pass. T10 remote smoke test remains for operator.

registry/indexes/capabilities.yaml

@@ -1,4 +1,23 @@
 version: 1
-updated: '2026-06-16'
-domain: helix_forge
-capabilities: []
+updated: '2026-06-22'
+domain: infotech
+capabilities:
+- id: capability.execution.sandbox-provision
+  name: Sandbox Provisioning
+  summary: Isolated execution environments for agentic development, e2e testing, and bounded automations — profile-based provision, TTL teardown, and State Hub lifecycle registration.
+  vector: D4 / A2 / C2 / R1
+  domain: infotech
+  status: draft
+  owner: sand-boxer
+  path: registry/capabilities/execution.sandbox-provision.md
+  tags:
+  - sandbox
+  - isolation
+  - provision
+  - e2e
+  - agentic
+  - execution
+  - profile
+  consumption_modes:
+  - CLI
+  - core library