[CMGS]

E1b: e2b-ci stops vendoring e2b's recipe. The owner rejected the copy in #251, because 2620 of its lines were e2b's own source.

Change

• Recipe fetched, not vendored: the build stage downloads e2b-dev/code-interpreter at CI_RECIPE_SHA (f56a1edf75) and checks the archive against CI_RECIPE_SHA256. It keeps only template/ and LICENSE, then runs patch -p1 with javascript-context.patch.
• The patch is ours, permanently: it creates the default javascript context only when Jupyter lists a javascript kernelspec. PATCHES describes it, and every recipe bump re-applies it.
• Upstream requirements.txt used as is: the e2b_charts pin already lives in constraints.txt.
• License: e2b's license ships in the image at /usr/share/doc/e2b-code-interpreter/LICENSE.
• Removed: os-image/e2b-ci/code-interpreter/. What remains is the Dockerfile with the sha as an ARG, the two constraints files, the two units, platforms, the patch plus PATCHES, and the docs.
• Upgrading the recipe: bump the two CI_RECIPE_* args and refresh the constraints.
• Docs: e2b.md describes the fetch and adds a sentence to the reproducibility paragraph: the docker exporter ignores rewrite-timestamp, so a local check exports OCI.

Evidence

• Reproducibility: two --no-cache OCI builds of this tree (linux/amd64, pinned base digest, SOURCE_DATE_EPOCH, rewrite-timestamp=true) gave the same manifest sha256:cc47851d6a80c0a97afbb26cddd84e6a3b82cadc7813a5354c0dd325679e02ea and the same single layer sha256:58050a7dfeff8eef6db08bdba5fd79f87940a3af505353feb31e4c5c5962f390.
• Build log: recipe.tar.gz: OK and patching file template/server/main.py. The layer contains usr/share/doc/e2b-code-interpreter/LICENSE, and root/.server/main.py has the kernelspec guard.
• Kit, envd-e2e.sh with SIZE=medium CODE_INTERPRETER=1, on host A's isolated root: every step ok, interpreter runs 1+1 in 75.3ms, ENVDSMOKE PASS.
• Kit, unmodified SDKs through the operator's e2b API. The mesh sandboxd is on main 6114e0d, so the re-import rebuilt the pool golden by itself (S4), about 10 s and 40 s after each host's import.
  • Python e2b-code-interpreter 2.10.0: run_code('1+1') returned '2', 164 ms from create.
  • JS @e2b/code-interpreter 2.8.0: runCode('1+1') returned "2", 189 ms from create.
• Unchanged: envdsmoke and envd-e2e.sh.

LOC

+58 / −2638, net −2580. No Go changes.