Implement SAND-WP-0008: host telemetry and self-canary

Add profile.sandbox-canary, HostSnapshot/inventory/stale schemas, SSH
collectors, before/after provision deltas, telemetry export to State Hub
and local JSON, default `sandboxer create` self-deploy, inspect/reap-stale
CLI, runbook, and CoulombCore verification (26 tests pass).

src/sandboxer/defaults.py

@@ -0,0 +1,30 @@
+"""Default paths and profile resolution for CLI."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+DEFAULT_CANARY_PROFILE = "profile.sandbox-canary"
+DEFAULT_COMPOSE_PROFILE = "profile.compose-e2e"
+
+
+def repo_root() -> Path:
+    override = os.environ.get("SANDBOXER_REPO_ROOT")
+    if override:
+        return Path(override).expanduser().resolve()
+    return Path(__file__).resolve().parents[2]
+
+
+def resolve_create_defaults(
+    profile: str | None,
+    inputs: dict[str, str],
+) -> tuple[str, dict[str, str]]:
+    """Apply default profile and repo per SAND-WP-0008-T06."""
+    resolved = dict(inputs)
+    user_repo = "repo" in resolved
+    if not user_repo:
+        resolved["repo"] = str(repo_root())
+    if profile is None:
+        profile = DEFAULT_COMPOSE_PROFILE if user_repo else DEFAULT_CANARY_PROFILE
+    return profile, resolved