Add workspace checkpoint API with SnapshotStore, extension hooks on
compose-ssh and saas-stub, manager orchestration, CLI/HTTP surface,
profile.compose-checkpoint, and docs/tests.
CoulombCore (92.205.130.254) authenticates as tegwick via id_ops in
ssh config, not root. Omit SANDBOXER_SSH_USER to let OpenSSH apply config;
set SANDBOXER_SSH_USER only to override.