feat: snapshot/restore checkpoints (SAND-WP-0007)

Add workspace checkpoint API with SnapshotStore, extension hooks on
compose-ssh and saas-stub, manager orchestration, CLI/HTTP surface,
profile.compose-checkpoint, and docs/tests.

SCOPE.md

@@ -1,7 +1,7 @@
 ---
 domain: infotech
 repo: sand-boxer
-updated: "2026-06-23"
+updated: "2026-06-24"
 ---
 
 # SCOPE
@@ -42,8 +42,9 @@ Lineage: provision/teardown extracted from `the-custodian/e2e-framework/`;
 ## In Scope
 
 - **Unified establishment API** — CLI v0 + HTTP stub (`create`, `get`, `list`,
-  `destroy`, `recreate`); fuller surface (`extend_ttl`, `snapshot`) planned
-- **Profile catalog** — `profile.compose-e2e`, `profile.sandbox-canary`; more
+  `destroy`, `recreate`, `snapshot`, `restore`); `extend_ttl` planned
+- **Profile catalog** — `profile.compose-e2e`, `profile.compose-checkpoint`,
+  `profile.sandbox-canary`; more
   profiles and extensions over time
 - **Extension platform** — `ext.compose-ssh` (SSH + compose); plugin contract in
   `docs/meta-framework.md`
@@ -146,7 +147,7 @@ cd ~/the-custodian && make e2e REPO=activity-core
 - TTL auto-expiry / `extend_ttl` enforcement
 - ~~`ext.vm-packer` attach mode~~ — done (SAND-WP-0005); Packer build orchestration deferred
 - Real E2B / Modal adapters (stub + payments v0 done in SAND-WP-0006)
-- Snapshot / restore / checkpoint profiles (SAND-WP-0007)
+- ~~Snapshot / restore / checkpoint profiles~~ — done (SAND-WP-0007)
 - Formal ops-bridge tunnel attachment in reachability descriptor
 - Dedicated sandboxer01 host (CoulombCore interim only today)
 - `reuse-surface validate` / federation publish workflow