Implement ext.bwrap: local bubblewrap namespace extension (SAND-WP-0013)

Adds the first local, same-host, kernel-namespace-only sandbox
extension: no SSH hop, no container runtime. Extends IsolationSpec.level
with "process", implements BwrapExtension (provision/wait_ready/
teardown) spawning bwrap with unshared user/mount/pid/ipc/uts/net
namespaces, registers ext.bwrap + profile.bwrap-local, and extends
manager._handle_from_status to carry pid/workspace_dir. Verified with a
live bwrap smoke run in addition to the mocked test suite.

T04 (reachability vs. the SSH-based glas-harness consumer contract)
deliberately left open pending glas-harness's harness contract.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/sandboxer/core/manager.py

@@ -65,6 +65,8 @@ class SandboxManager:
             "endpoint": status.inputs.get("endpoint", ""),
             "provider_sandbox_id": status.inputs.get("provider_sandbox_id", ""),
             "provider": status.inputs.get("provider", ""),
+            "pid": status.inputs.get("pid", ""),
+            "workspace_dir": status.inputs.get("workspace_dir", ""),
         }
 
     def _resolved_host(self, profile, extension, host_override: str | None) -> str:
@@ -154,6 +156,8 @@ class SandboxManager:
             status.inputs["endpoint"] = handle.get("endpoint", "")
             status.inputs["provider_sandbox_id"] = handle.get("provider_sandbox_id", "")
             status.inputs["provider"] = handle.get("provider", "")
+            status.inputs["pid"] = handle.get("pid", "")
+            status.inputs["workspace_dir"] = handle.get("workspace_dir", "")
             reach = backend.wait_ready(handle)
             reach = enrich_reachability(reach, profile, handle)
             status.reachability = Reachability(**reach)