Add sandbox support for concurrent agent OCI commands

[leefaus]

This pull request introduces a new "sandbox" feature to Atomic, enabling concurrent agents to work on isolated, copy-on-write clones of the repository's working tree while sharing a single canonical graph. It adds a new CLI command (atomic sandbox) with subcommands for creating, staging, and sealing sandboxes, and updates repository logic to recognize and operate within sandboxed environments. Supporting infrastructure for OCI image creation and copy-on-write cloning is also included.

Sandbox CLI and Workflow:

• Added a new atomic sandbox CLI command with create, stage, and seal subcommands to provision, package, and deploy concurrent agent sandboxes. This allows multiple agents to work in parallel with isolated build artifacts and shared history. [1] [2] [3]
• Updated CLI module exports and command dispatch to support the new sandbox command. [1] [2] [3]

Repository and Sandbox Detection:

• Enhanced repository root detection and opening logic to recognize sandbox working trees (which contain a .atomic-sandbox pointer instead of a .atomic/ directory), enabling all repository operations to work transparently inside sandboxes. [1] [2] [3] [4]
• Exposed new sandbox-related types and constants (SealOptions, StageOptions, etc.) from the repository crate for CLI integration.

Copy-on-Write and OCI Image Support:

• Added dependencies on reflink-copy, tar, flate2, and sha2 crates to enable efficient copy-on-write cloning and OCI image packaging for sandboxes. [1] [2]
• Introduced a new oci module in the repository crate to support OCI image layout production for sandbox staging and sealing.

Documentation:

• Updated README.md with a detailed explanation of the sandbox model, its benefits, usage examples, and integration with smolvm for fast, reproducible agent environments.

Summary of most important changes:

1. Sandbox CLI and Workflow

• Added atomic sandbox CLI command with create, stage, and seal subcommands for concurrent agent sandboxes. [1] [2] [3]
• Updated CLI exports and command dispatch to include sandbox support. [1] [2] [3]

2. Repository and Sandbox Detection

• Improved repository root-finding and opening to recognize sandbox working trees via .atomic-sandbox pointer, enabling transparent use inside sandboxes. [1] [2] [3] [4]
• Exposed new sandbox-related types and constants for CLI integration.

3. Copy-on-Write and OCI Image Support

• Added dependencies and modules for copy-on-write cloning (reflink-copy) and OCI image packaging (tar, flate2, sha2). [1] [2] [3]

4. Documentation

• Expanded README.md with a new section on concurrent agent sandboxes, usage, and design rationale.concurrent agent sandbox OCI docs and commands.