refactor: isolate provider auth, lifecycle and protocol assembly

[anycodes]

Description

Selecting a backend could still enter Express authentication/template code or inherit its data-plane addresses and headers. Every lifecycle operation now uses the selected Provider. Core consumes structural contracts; authentication, API mapping, protocol selection, template deployment/polling, port/file URLs and backend CLI/AI metadata belong to adapters.

Refs #52. Counterpart: Alibaba-Agent-Sandbox/agent-sandbox#35. Separate native image-factory proposals remain unactivated and require their own backend acceptance.

Type of Change

• Bug fix
• Refactoring
• Documentation
• Tests

Changes

• Route bundled and external providers through owned infrastructure/session factories; preserve public compatibility facades and lazy Python imports.
• Reject undeclared configuration, missing template/port/file hooks and foreign defaults with E8004 instead of fabricating native behavior. Async-only ports use network.resolve.
• Keep Express auth, FC/ACR deployment, polling, specialized prompts/options and AI metadata in its adapter. Explicitly selected shared E2B adapters own wire conventions.
• Preserve current main's API-key-only sandbox authentication and retired native Python gRPC path. AK/SK management does not silently provision a sandbox key.
• Recompute selected-provider CLI/AI schemas and handlers together; keep created-versus-borrowed cleanup ownership.
• Report bundled updates as host-release upgrades with current version and unknown latest version; keep consented Git-plugin update and rollback behavior.
• Preserve resource reuse while documenting SDK/config migration limits in English and Chinese. This is not a zero-change SDK substitution.

Testing

• Latest full client: 2177 passed, 24 skipped. Both-package ruff/format/mypy and distribution checks pass. Local server aggregate: 853 passed, 2 malformed-request cases fail through the network intermediary, 1 skipped. The preceding hosted matrix passed all nine checks; latest-head hosted Python 3.10/3.11/3.12 remains required.
• Executable real Express cloud/management acceptance passes all applicable scenarios, including process info and measured metrics. Two owned sandboxes deleted; zero leaked. Initial combined offline failures were caused by inherited region configuration in the harness; fixed offline rerun: 61 passed, 1 no-resource leak-check skip.
• Configured Python Express full E2E was repeated after the port changes; final result remains pending. Earlier current-host run: 116 passed, 6 skipped, 2 deselected, 1 documented platform xfail.
• Repository health/hygiene and configured-secret scans pass. No credentials or raw sensitive logs are included.
• Checkpoints are immutable: .agents/evidence/verify/2026-10-18-provider-current-host-checkpoint.md and 2026-10-18-provider-port-url-boundaries.md. Final current-head evidence follows separately.

Checklist

• Contracts, tests and bilingual docs updated
• CHANGELOG and repository engineering records included
• No configured credentials committed; task resources cleaned up

Definition of Done

• Scoped regressions and real components exercised
• Proposed ADR and dated verification evidence
• English/Chinese docs and CHANGELOG
• Repository health/hygiene
• Latest-head hosted aggregate checks pass
• Final repeated Express SDK E2E and evidence complete

Draft while the last checks run. No native E2B/Cube/container/OpenSandbox acceptance is claimed without its own configured environment.

Integration convergence retains remote937eb5e through ordinary merge, including provider-owned port/file addressing and lazy compatibility exports. Pure lower metadata and canonical auth aliases remain. Local real Express112 PASS, zero residual sandboxes; client/type/package/server limitations are recorded under .agents/evidence/verify/2026-10-18-provider-main-integration.md. Exact current-head CI/review is required before merge.