build: package the complete gVisor akernel.3 runtime bundle

[tianyuzhou95]

Summary

Advance sandboxd from f7ab6d4a to public main e67b2585, which includes inclusionAI/sandboxd#60, and consume the promoted gVisor release-20260817.0-akernel.3 archive through sandboxd's checksum-verifying installer. Copy runsc, the containerd shim, and all four adjacent gvisor-bin/ helpers into the final node image rather than installing only runsc.

Extend CI's final-image checks to require every helper and document the complete-bundle contract. Runtime release URLs and checksums remain owned by the sandboxd manifest; there are no AKernel-specific overrides or runtime downloads of missing helpers.

The gitlink also brings the already-merged sandboxd changes for additional runsc arguments (#58), writable Firecracker virtio-fs directory mounts (#57), and shared ChunkDB capacity (#59). This PR does not change deployment defaults to opt into those features. YuanRong core/RRT remain 0.10.2rc6, the default SDK backend remains 0.10.2rc9, and the legacy actor SDK remains pinned to 0.9.9. Other component pins are unchanged.

Validation

All manual compilation and runtime validation took place on the dedicated test node, not the local workstation. The public runsc-only two-Dockerfile build uses the published gVisor URL and digest, not the former candidate mirror. The complete sandboxd runtime matrix already passed in the merged upstream PR.

• Public runtime and node Dockerfile builds passed with the promoted release URL and unmodified upstream pins. The initial attempt encountered an expired test-node proxy tunnel; rebuilding after restoring that tunnel succeeded.
• Final node image: sha256:22212a310f3aee6af3cdddb449a11010776f386f536357808b6d2f816205cb7c. All six gVisor executables are executable and byte-for-byte identical to the promoted candidate bundle.
• Fresh isolated standalone: all seven integration tests passed in 70.436 seconds, including private OCI root isolation, checkpoint/reload and reverse tunnel recovery.
• make sdk-check: 273 unit tests, Ruff and mypy passed.
• make deploy-script-check, make versions, and git diff --check passed.

Standalone testing used a separate native-XFS data directory, container names, and cgroup root on the existing test host; private registry credentials remain outside the PR. The manual node build follows the public CI runsc-only profile and does not claim to rebuild or revalidate GPU/Kata/Firecracker payloads in AKernel.

Known independent limitation

Extended concurrent creation/reload testing previously exposed a YuanRong stop/recovery lifecycle race (instance exist but not the same one, 80025) on this public AKernel baseline. The stale retry/response sequence was also seen with the prior runsc release in a separate ordinary-sandbox control test. YuanRong maintainers are handling that issue separately. This dependency update does not claim to fix it or to have passed the extended mixed-pressure workload. No production cluster, internal ACI configuration, or internal branch is changed.

[rcyw]

Non-blocking documentation consistency note: this sandboxd gitlink also includes inclusionAI/sandboxd#57. Bundled standalone, Helm, and Terraform configurations already enable Firecracker virtio-fs, so lower-level callers can now explicitly request writable host-directory binds, although existing mounts and the Python SDK Mount API remain read-only by default.

Could we update AGENTS.md, deploy/README.md, and sdk/python/README.md to distinguish those two surfaces? The writable-bind documentation should also retain the sandboxd contract that caller-owned host data is outside storage_mb and checkpoint artifacts, requires the original directory for local restore, and is not migrated across nodes. This does not need to block the gVisor bundle integration.

[rcyw]

The complete gVisor bundle is checksum-verified, installed as one version-matched set, and covered by final-image checks. CI is green. The writable virtio-fs documentation follow-up is non-blocking and recorded in the PR discussion.