build: the cloud frontend stands alone

The Durable Object, the sandbox daemon, and their deploy assets
leave the rhema workspace for a repository of their own. The DO
was already a deployment artifact (publish = false, worker feature
wasm-only), and rhema-sandbox-server's only consumer was the image
beside it — both are product, not framework. The harness and the
seam stay behind: rhema-cloud-agent and the sandbox family join
the rhema repository's publish list, and this tree consumes them
from crates.io at 0.2.6, the same arrangement the claw keeps its
framework crates under.

The sandboxd image build carries the fix its extraction needed:
the old Dockerfile still staged the claw's workspace (claw and
tools manifests, integrations globs, the vendored crossterm) and
missed rhema-provider-registry's manifest entirely. The manifest
stage is now this workspace's two members, fetched from the
registry.

Not yet buildable: the rhema 0.2.6 batch (rhema-sandbox,
-local, -http, rhema-cloud-agent) must publish first — then one
cargo check generates Cargo.lock and CI goes green.

deploy/docker/README.md

@@ -0,0 +1,39 @@
+# Docker images
+
+Every Dockerfile here builds from the repository root as its context:
+
+```sh
+docker build -f deploy/docker/<name>.Dockerfile -t <name> .
+```
+
+## rhema-sandboxd
+
+The sandbox wire protocol served from a host: one root directory per
+session under a fixed base, `bash -c` exec under a `timeout` budget,
+files and seeds on the fs, the token checked on every route
+(`specs/rhema-sandbox.md` §3).
+
+Build and run:
+
+```sh
+docker build -f deploy/docker/sandboxd.Dockerfile -t rhema-sandboxd .
+
+docker run -d --name sandboxd \
+  -p 7600:7600 \
+  -v sandboxd-base:/var/lib/rhema-sandboxd \
+  rhema-sandboxd --port 7600 --token "$(openssl rand -hex 32)"
+```
+
+- `--token` has no environment default: the runner passes the shared
+  secret on the command line; clients send it in `x-rhema-token`.
+- `--port` must be passed — the binary's default is `0` (OS-picked),
+  which a published mapping cannot follow. The image binds `0.0.0.0`
+  (the binary's own default is loopback; overriding the host means
+  overriding the entrypoint).
+- The base (`-v`) holds one directory per session name; mount a volume
+  or bind mount there, or every session dies with the container.
+
+A client reaches it with `HttpSandbox` (feature `client`): the base URL
+is `http://<host>:<port>`, and the session name is the first path
+segment of every route — `POST {base}/{session}/exec|/put|/get|/seed`,
+plus `GET /healthz` at the root, token required there too.

deploy/docker/sandboxd.Dockerfile

@@ -0,0 +1,79 @@
+# rhema-sandboxd: the sandbox wire protocol served from a host.
+# Build from the repo root (the context is the repo):
+#   docker build -f deploy/docker/sandboxd.Dockerfile .
+
+# The builder tag tracks rust-toolchain.toml: the pinned channel is
+# what every commit is tested against. The full image (not -slim)
+# keeps a C toolchain in reach for the compiled pieces a dependency
+# may pull (the dev deps' reqwest rides rustls), while the graph
+# itself stays pure Rust.
+FROM rust:1.98.1 AS builder
+WORKDIR /build
+
+# Manifests first: the registry cache this populates survives source
+# edits. The harness and the seam family (rhema-cloud-agent,
+# rhema-sandbox, -local, -http) come from crates.io at the pinned
+# versions, so these two member manifests plus the lockfile are the
+# whole workspace graph.
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+COPY crates/rhema-cloudflare-code/Cargo.toml crates/rhema-cloudflare-code/Cargo.toml
+COPY crates/rhema-sandbox-server/Cargo.toml crates/rhema-sandbox-server/Cargo.toml
+
+# Cargo validates explicit target
+# paths at manifest-parse time, so the fetch needs stub files at every
+# declared target path: src/ for every member, plus examples/tests/benches
+# as declared (default path from the target name, or the explicit `path`).
+# The glob's */src matches nothing until the stub exists — an unmatched
+# glob would hand mkdir a literal path. The real sources land below.
+# (The awk program must stay on one line: a Dockerfile line not ending
+# in a backslash ends the RUN.)
+#
+# No src/main.rs stub: most members have no default binary, the stub
+# would survive `COPY . .`, and the phantom autobin it creates fails
+# E0601 the moment that member is the `-p` package — which is
+# rhema-sandbox-server, were the stub not skipped. Declared [[bin]]
+# paths are never stubbed either — the awk stubs examples/tests/benches
+# only — and fetch needs no bin to exist.
+RUN for crate in crates/*/; do \
+           mkdir -p "$crate/src"; \
+           touch "$crate/src/lib.rs"; \
+           awk -F'"' '/^\[/ { d = ""; p = 0; if ($0 == "[[example]]") { d = "examples" } else if ($0 == "[[test]]") { d = "tests" } else if ($0 == "[[bench]]") { d = "benches" }; next } d == "" { next } /^name = / && p == 0 { print d "/" $2 ".rs" } /^path = / { p = 1; print $2 }' "$crate/Cargo.toml" \
+           | while IFS= read -r target; do \
+                 mkdir -p "$crate$(dirname "$target")"; \
+                 touch "$crate$target"; \
+             done; \
+       done \
+    && cargo fetch
+
+# Sources. target/ and .git never land here: the repo-root .dockerignore
+# keeps them out of the context.
+COPY . .
+
+RUN cargo build --release --locked -p rhema-sandbox-server
+
+FROM debian:stable-slim
+
+# coreutils — the `timeout` prefix the exec route wraps every command
+# in — ships with debian-slim; bash does not. git and the CA store are
+# load-bearing too: a `{git}` seed is a `git clone` (tarball seeds need
+# neither).
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends bash git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Numeric USER: Kubernetes cannot verify runAsNonRoot against a name.
+RUN useradd --uid 1000 --user-group --create-home sandboxd \
+    && install -d -o 1000 -g 1000 /var/lib/rhema-sandboxd
+
+COPY --from=builder /build/target/release/rhema-sandboxd /usr/local/bin/rhema-sandboxd
+
+# The base and the bind host are fixed to the image — the binary's
+# default host is loopback, unreachable through a published port, and
+# `docker run` arguments replace CMD wholesale, so a per-run default
+# would never survive the always-present `--token`. The token and port
+# are per-run flags appended to the entrypoint (`--token` has no
+# environment fallback — the runner passes it). No EXPOSE: `--port`
+# defaults to 0 (OS-picked), so the image fixes no port.
+VOLUME /var/lib/rhema-sandboxd
+USER 1000:1000
+ENTRYPOINT ["/usr/local/bin/rhema-sandboxd", "--base", "/var/lib/rhema-sandboxd", "--host", "0.0.0.0"]