[Vercel] first isolated provider via @vercel/sandbox

[pyadav]

Parent

#1

What to build

Add the Vercel isolated sandbox provider — the first real implementation of the isolated factory abstraction declared in #3 (Types). Provisions a Firecracker microVM via @vercel/sandbox. Imported from @missingstudio/sanddune/sandboxes/vercel.

Implements the full isolated handle contract: exec (with optional streaming via onLine), copyIn (file or directory), copyFileOut, close, and worktreePath (the sandbox-side path where the repo lives). sanddune handles syncing code in (via copyIn) and extracting commits out (via copyFileOut + git plumbing).

Default branch strategy: merge-to-head (per #3 — isolated providers reject head).

Acceptance criteria

• vercel() factory exported from @missingstudio/sanddune/sandboxes/vercel
• Built via createIsolatedSandboxProvider
• Provisions a Firecracker microVM via @vercel/sandbox
• Implements the full isolated handle contract: exec (with onLine streaming), copyIn (file or directory), copyFileOut, close, worktreePath
• exec returns { stdout, stderr, exitCode }
• sanddune wires up copyIn to sync the repo into the sandbox at start, copyFileOut + git ops to extract commits at end
• Default branch strategy is merge-to-head; head rejected at type level (already enforced in [Types] Public types, interfaces, entry-point stubs (no implementation) #3) and runtime
• env provider option supported
• name field exported for telemetry/error messages (e.g. "vercel sandbox failed: ...")
• Unit tests against a fake Vercel client: copyIn round-trip, exec streaming, close
• Smoke test against real Vercel (CI-flag-gated, requires VERCEL_TOKEN) confirms a commit lands
• bun test and bun run typecheck pass

Blocked by

• [Tracer bullet] run() with Docker + Claude Code + head + inline prompt #4