Allow labels on Docker sandbox containers

[seanxuu]

Fixes #4562

This pull request adds optional Docker container labels to DockerSandboxClientOptions, persists them in DockerSandboxSessionState, and forwards them when resume creates a replacement container. Existing unlabeled Docker create calls keep their current keyword shape.

Validation:

• Focused sandbox tests: 159 passed, 19 skipped
• Ruff and targeted Pyright: passed
• Full repository test/typecheck gates remain blocked by pre-existing optional-dependency and extension failures; details are recorded in the contribution handoff.

[koadegno]

Thanks for opening this. I had already completed an implementation for #4562 before this PR was opened, so rather than opening a competing PR I'd prefer to help consolidate the work here.

There are a few cases that I think still need to be covered before this is ready:

• Since DockerSandboxSessionState is persisted through RunState, adding labels changes the durable state contract. The RunState schema should be bumped from 1.16 to 1.17, with a corresponding schema summary and an actual RunState JSON round-trip test.
• When resume() reuses an existing container, the persisted labels should be checked against the actual container labels, similarly to the existing network configuration validation. Missing or mismatched expected labels should reject the resume, while extra container labels can remain allowed.
• _create_container() should use if labels: rather than if labels is not None so an empty mapping does not change the existing unlabeled Docker create kwargs.
• Compatibility coverage should include older persisted state without a labels field, matching/missing/mismatched labels on an existing container, and replacement-container label preservation.

I already have these cases implemented and tested on koadegno:agent/docker-sandbox-labels-clean at commit 8012e0505f6b3625d2f0dacf76ee4db863b9a3e9. The focused suite passes 176 tests.

Feel free to use that implementation as a reference or cherry-pick whatever is useful.

[seanxuu]

Thanks for opening this. I had already completed an implementation for #4562 before this PR was opened, so rather than opening a competing PR I'd prefer to help consolidate the work here.

There are a few cases that I think still need to be covered before this is ready:

• Since DockerSandboxSessionState is persisted through RunState, adding labels changes the durable state contract. The RunState schema should be bumped from 1.16 to 1.17, with a corresponding schema summary and an actual RunState JSON round-trip test.
• When resume() reuses an existing container, the persisted labels should be checked against the actual container labels, similarly to the existing network configuration validation. Missing or mismatched expected labels should reject the resume, while extra container labels can remain allowed.
• _create_container() should use if labels: rather than if labels is not None so an empty mapping does not change the existing unlabeled Docker create kwargs.
• Compatibility coverage should include older persisted state without a labels field, matching/missing/mismatched labels on an existing container, and replacement-container label preservation.

I already have these cases implemented and tested on koadegno:agent/docker-sandbox-labels-clean at commit 8012e0505f6b3625d2f0dacf76ee4db863b9a3e9. The focused suite passes 176 tests.

Feel free to use that implementation as a reference or cherry-pick whatever is useful.

Done