Move provider configuration behind typed adapter codecs

[SaladDay]

Core previously carried E2B configuration through shared selection types, storage columns, management DTOs, discovery routes and error mapping. Mandatory adapter codecs now own native configuration semantics and separate public selectors, safe observations and encrypted secret bytes. Docker and microsandbox explicitly reject unsupported operations; E2B retains credential rotation and immutable generation ownership inside its adapter. Missing configuration requirements return contract errors instead of silently disabling checks.

The management API and console use configuration, write-only credential, safe metadata and POST /core/v1/sandbox/providers/{provider}/discovery. Migration 91 preserves existing ciphertext and retained generations and rejects lossy downgrades. Management clients must upgrade with Core; the pinned public /v1 API and Runtime protocol are unchanged.

Validation:

• Linux PostgreSQL Store, execution, server and provider suites passed, including migration up/down, ciphertext preservation and retained-generation ownership.
• An additional test provider completes a real management API-to-Store configuration round trip without adding native fields to Core.
• Client unit tests (756), TypeScript checks, contract-route checks and repository documentation/distribution checks passed. The full gate reached Web tests (450/451); its stale Chinese localization expectation was corrected in #270, whose four focused tests passed.
• Browser acceptance passed 85/86 initially; the reset-dialog timing failure passed three consecutive targeted reruns without a code change.
• Independent full-diff review completed; its server requirement-check finding was fixed and verified with focused server/provider tests.

Official-client and Linux, macOS and Windows checks passed on the identical task patch before the last unrelated main synchronization. The full gate was attempted but is not claimed as a complete pass; the final test-only correction received focused verification. Complete provider registration validation is a separate follow-up; no release or deployment is included.