feat(sandbox): add Aliyun AgentRun sandbox client

[iridescentWen]

Summary

Add a new optional sandbox backend that targets the Alibaba Cloud AgentRun CodeInterpreterSandbox. The integration follows the same patterns as the existing hosted clients (Vercel/Cloudflare/Blaxel): an optional [aliyun] extra, guarded re-exports under agents.extensions.sandbox, and a single-file example runner.

Notable design decisions:

• Credentials (access_key_id, access_key_secret, account_id, api_key) live on the AliyunSandboxSession and AliyunSandboxClient instances, never on AliyunSandboxSessionState. Serialized session state therefore never carries secrets to disk; a regression test pins this.
• AgentRun does not currently expose tunneled ports or hosted-specific mount strategies, so _resolve_exposed_port raises ExposedPortUnavailableError and no mounts.py module is added.
• Resume always re-provisions a fresh sandbox because AgentRun sandboxes are not reliably re-addressable by id once the client process exits.

Test plan

• make format, make lint, make typecheck, make tests — aliyun changes produce zero new errors; 50/50 tests/extensions/sandbox/test_aliyun.py cases pass.
• make build-docs builds without new warnings.
• Manual import smoke test with the real agentrun-sdk==0.0.35 installed: uv run python -c "from agents.extensions.sandbox import AliyunSandboxClient, AliyunSandboxClientOptions, AliyunSandboxSession, AliyunSandboxSessionState; print('ok')".
• examples/sandbox/extensions/aliyun_runner.py --stream is available for end-to-end verification when valid Alibaba Cloud credentials are present.

Issue number

N/A

Checks

• I've added new tests (if relevant)
• I've added/updated the relevant documentation
• I've run make lint and make format
• I've made sure tests pass