Implement SAND-WP-0008: host telemetry and self-canary

Add profile.sandbox-canary, HostSnapshot/inventory/stale schemas, SSH
collectors, before/after provision deltas, telemetry export to State Hub
and local JSON, default `sandboxer create` self-deploy, inspect/reap-stale
CLI, runbook, and CoulombCore verification (26 tests pass).

src/sandboxer/models.py

@@ -83,6 +83,7 @@ class ReachabilitySpec(BaseModel):
 class ProfileMetadata(BaseModel):
     cost_class: Literal["self-hosted", "saas-metered"] = "self-hosted"
     latency_class: str = "standard"
+    observability: Literal["none", "canary"] = "none"
 
 
 class Profile(BaseModel):
@@ -141,6 +142,7 @@ class SandboxStatus(BaseModel):
     reachability: Reachability | None = None
     inputs: dict[str, str] = Field(default_factory=dict)
     error: str | None = None
+    telemetry: dict | None = None  # IntrospectionReport JSON when canary
     created_at: datetime
     updated_at: datetime
     ready_at: datetime | None = None