Implement SAND-WP-0003: validation meta-framework extraction

Port e2e-framework schema, runner, and reporter into wise-validator with
sand-boxer CLI integration, validate run CLI, unit tests, registry capability,
and operator docs.

tests/test_sandbox_client.py

@@ -0,0 +1,59 @@
+"""sand-boxer CLI client tests."""
+
+import json
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from wisevalidator.sandbox_client import create_sandbox, destroy_sandbox
+
+
+def test_create_sandbox_parses_ready_status(tmp_path) -> None:
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    payload = {
+        "sandbox_id": "cli12345",
+        "state": "ready",
+        "host": "coulombcore",
+        "reachability": {
+            "ssh": "root@coulombcore",
+            "host": "coulombcore",
+            "remote_dir": "/tmp/sandboxer/cli12345",
+            "compose_project": "sbx-e2e-cli12345",
+        },
+    }
+
+    proc = MagicMock(returncode=0, stdout=json.dumps(payload), stderr="")
+
+    with (
+        patch("wisevalidator.sandbox_client.shutil.which", return_value="/bin/sandboxer"),
+        patch("wisevalidator.sandbox_client.subprocess.run", return_value=proc),
+    ):
+        handle = create_sandbox(repo)
+
+    assert handle.sandbox_id == "cli12345"
+    assert handle.remote_dir == "/tmp/sandboxer/cli12345"
+
+
+def test_create_sandbox_not_ready_raises(tmp_path) -> None:
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    payload = {"sandbox_id": "bad12345", "state": "failed", "error": "compose up failed"}
+    proc = MagicMock(returncode=0, stdout=json.dumps(payload), stderr="")
+
+    with (
+        patch("wisevalidator.sandbox_client.shutil.which", return_value="/bin/sandboxer"),
+        patch("wisevalidator.sandbox_client.subprocess.run", return_value=proc),
+        pytest.raises(RuntimeError, match="sandbox not ready"),
+    ):
+        create_sandbox(repo)
+
+
+def test_destroy_sandbox() -> None:
+    payload = {"sandbox_id": "cli12345", "state": "destroyed"}
+    proc = MagicMock(returncode=0, stdout=json.dumps(payload), stderr="")
+
+    with patch("wisevalidator.sandbox_client.subprocess.run", return_value=proc):
+        out = destroy_sandbox("cli12345")
+
+    assert out["state"] == "destroyed"