Runenv revised

[jhlee525]

Summary

The RunEnv / RunEnvHandle indirection — an Arc-counted wrapper that wrapped a Box<dyn MachineDyn> and managed start-on-first-get / stop-on-last-drop ref-counting — is gone. Agents now share a Machine directly via a SharedMachine = Arc<Mutex<dyn MachineDyn>> handle, with explicit start / stop and no implicit lifecycle.

This removes a layer of state that always existed and was always a half-step out of sync with the underlying machine. The previous design hid two correctness pitfalls behind the ref-count:

• Pure tools (ones that never need a console) would still boot the machine on first get, even when nothing would touch the console.
• RunEnvHandle::Drop's background stop kept Arc semantics surprising: dropping the last handle was the only way to actually stop the VM, but callers couldn't tell which Arc::clone was the last one without inspecting refcounts.

After this PR, the machine's running state is exactly what Machine::is_running reports, and ToolFunc carries enough type-level information for the runtime to skip starting the machine for tools that don't need it. The companion microsandbox bump to v0.5.4 lets us delete the ailoy-side /tmp volume management that #416 had to put in place to compensate for missing upstream behaviour.

Changes

1. refactor(runenv): drop RunEnv wrapper, expose Machine via SharedMachine (85e0e81)

• Machine trait reshape. Add is_running. start now returns &Console whose lifetime is tied to &mut self, so a console borrow holds the machine for the duration of a tool stream. stop returns Result and defaults to no-op.
• SandboxConfig → SandboxBuilder. The struct + builder split is collapsed into a single chainable SandboxBuilder. Per-process /tmp volume sweeping and the ailoy.managed label scheme introduced in fix(runenv): unblock Drop, persist /tmp, rename Machine verbs, bump msb 0.5.0 #416 are gone — microsandbox::SandboxConfig is reused directly (see the dep bump below).
• ToolFunc splits. ToolFunc::Pure and ToolFunc::WithConsole, with a public needs_console(). The runtime skips locking and starting the machine for pure tools in execute_tool_calls. Builtins that need shell access — shell, read, write, edit, apply_patch, glob, grep, python_repl — take &dyn Console instead of Arc<RunEnvHandle>.
• AgentBuilder / Agent API renames. .runenv(..) → .machine(..) (owned) and .shared_machine(..) (pre-shared handle); Agent::try_with_runenv → Agent::try_with_machine; subagents inherit the parent machine via Arc::clone.

2. chore(deps): bump microsandbox 0.5.2 → 0.5.4 (rolled into 85e0e81)

The runenv refactor depends on this bump for two reasons:

• Drop ailoy-side /tmp volume management. fix(runenv): unblock Drop, persist /tmp, rename Machine verbs, bump msb 0.5.0 #416 added per-sandbox named volumes (ailoy-tmp-{name}) with an ailoy.managed label and a startup sweep, working around microsandbox not having a first-class auto-volume API. The 0.5.4 release ships that auto-volume work upstream, so the ~200 lines of label-tracking, sweep, and rollback logic in runenv/sandbox.rs collapse to a direct microsandbox::SandboxConfig reuse.
• SandboxBuilder parity. The chainable builder this PR introduces mirrors the upstream builder API surface that landed in 0.5.3/0.5.4.

Cargo.toml: microsandbox = "0.5.2" → "0.5.4". cargo update regenerates lock-file entries for microsandbox-* crates and their transitive deps.

3. refactor(runenv): promote SharedMachine to a struct (891563c)

The handle moves out of agent::rt into runenv, alongside the Machine trait it wraps. The Arc<Mutex<dyn MachineDyn>> type alias and free shared_machine() helper are replaced with #[derive(Clone)] struct SharedMachine exposing new, get, and a From<M: Machine> impl. Agents pass SharedMachine around as an opaque handle; callers don't need to know about the Arc<Mutex<>> shape.

4. refactor(agent): split subagent module, introduce AgentParts, drop spec field (107b422)

Riding on the new Machine API, the agent-side wiring gets a parallel cleanup:

• Sub-agent ToolFunc construction moves from tool/impl/subagent.rs into agent/subagent.rs so it can share Agent-internal resolution helpers with agent/rt.rs.
• AgentParts: everything that depends on AgentProvider is resolved once at outer-call time (model factory + options, tool descs and funcs, the flattened file list, the system message). The sub-agent closure captures only this owned, Clone-able struct — no per-invocation AgentProvider clone.
• LangModelFactory: LangModelProvider::provide now returns a cheap factory that can be cloned freely and turned into a LangModel lazily via .make(). This is what lets AgentParts defer the actual LangModel construction to the moment a sub-agent is actually invoked.
• Agent no longer retains AgentSpec. Files are pre-flattened across the sub-spec subtree at construction time; skills and card_name are lifted onto the runtime struct directly. Adds Agent::files() accessor. Agent::spec() is removed.
• AgentState moves to its own module (agent/state.rs).

5. chore(agent): remove dead subagent file (012a854)

src/tool/impl/subagent.rs was already dead (its mod declaration was commented out in step 4). Deleting the file and dropping the leftover commented-out lines in src/tool/impl/mod.rs.

[khj809]

agent-k already depends on this volume mount for mounting project/session files. Why did you decide to remove this, and how you're planning to mount the files without this?