refactor(sandbox): adopt Pydantic provider configs

[hemildesai]

Summary

• Convert provider-neutral sandbox specs/resources and every built-in provider configuration/options DTO to frozen Pydantic models with strict extra-field validation.
• Add provider-neutral SandboxSpec.resource_requests, validate numeric requests do not exceed limits, and map separate requests in OpenSandbox without leaking provider-specific options into shared config.
• Preserve legacy positional construction and latest-main behavior for ports, endpoints, Docker host publishing, OpenSandbox background execution, and connection health checks.
• Forward requests and ports through all config-backed sandbox builders, including MiniSWE, AnySWE, PinchBench, Litmus, SWE-bench, OpenCode, and Harbor.

Why

Pydantic gives sandbox configuration a consistent validation, normalization, and serialization path. Making scheduling requests a first-class provider-neutral field also keeps agent configuration portable across providers.

Compatibility and impact

• Existing mappings and typed model instances remain accepted.
• resource_requests is optional; omission preserves each provider's current behavior.
• Runtime handles, execution results, endpoints, and private provider state remain dataclasses because they are not configuration inputs.
• Existing pre-merge provider_options.resource_requests examples are migrated directly; no compatibility shim is needed.

Validation

• Sandbox/provider unit suite: 705 passed, 4 skipped; the known macOS Enroot /proc case was deselected.
• Affected resource-server/agent suites: 143 passed, plus 19 MiniSWE tests passed separately.
• OSWorld sandbox-provider suite: 8 passed.
• Ruff lint and format checks passed for all changed Python files.
• Fern docs check: 0 errors; only the expected unauthenticated redirects warning.
• Harbor YAML, compilation, lint, and behavioral smoke checks passed. The optional Harbor and CVDP test modules were not collected because the workspace lacks their pinned Harbor and NLTK dependencies.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-codex-pydantic-sandbox-specs.docs.buildwithfern.com/nemo/gym

Here are the markdown pages you've updated:

• nemo/gym/infrastructure/sandbox/adding-a-provider
• nemo/gym/infrastructure/sandbox
• nemo/gym/infrastructure/sandbox/opensandbox