feat(sandbox): run new production sessions on E2B

[skrishnan22]

Switches production to the E2B sandbox provider added in #72.

What changes

• packages/worker/wrangler.toml: SANDBOX_PROVIDER = "e2b".
• On merge, the e2b-template CI job builds this commit's sandbox image, pushes it to GHCR, and publishes it as the E2B template tagged with the commit SHA. The deploy job then ships the Worker pinned to E2B_TEMPLATE_ID = "codevil-sandbox:<sha>". A failed publish stops the deploy.
• Existing sessions keep the provider they started on (Cloudflare). Only new sessions use E2B.
• README and the deployment-config test updated to match.

Prerequisites (done)

• E2B_API_KEY GitHub Actions secret in the production environment.
• E2B_API_KEY Worker secret.

First E2B deploy is also the first live check of

• E2B pulling the private GHCR image with the job's GITHUB_TOKEN.
• E2B accepting the explicit default tag alongside the SHA tag.
• Sandbox.create("codevil-sandbox:<sha>") resolving the tagged build.

If any fails, the publish job fails and the Worker is not deployed.

After deploy: manual check on production

1. Create a session on a real repo; clone and npm install complete.
2. Start preview; hot reload works through the Codevil preview URL.
3. Create a session with max_idle_time: 2m, leave it idle; it pauses in the E2B dashboard.
4. Resume once with a prompt and once by opening the preview; dev server still running.
5. Stop the session; the sandbox is gone from the E2B dashboard.

Rollback: set SANDBOX_PROVIDER = "cloudflare" and merge. Keep the E2B_API_KEY secret while any E2B sessions exist.

Verification

pnpm verify passes locally (typecheck + all package tests, 0 failures).

🤖 Generated with Claude Code