feat: add autoresearch-spark sandbox for DGX Spark (GB10)

[pimlock]

Summary

• Adds sandboxes/autoresearch-spark/ — a containerized sandbox for running karpathy/autoresearch on the NVIDIA DGX Spark (GB10 / Blackwell)
• Uses nvidia/cuda:13.0.0-cudnn-devel-ubuntu24.04 as base image for sm_121a ptxas support (Triton kernel compilation), with PyTorch cu128 wheels
• Mirrors the community base devtools: Claude CLI, Codex, OpenCode, GitHub CLI, uv, Node.js 22

What's included

sandboxes/autoresearch-spark/
  Dockerfile              # CUDA 13.0 base + community devtools + autoresearch
  policy.yaml             # Runtime network policy (agent tools + HuggingFace data)
  policy-dev.yaml         # Dev policy (adds PyPI/PyTorch for package installs)
  README.md
  autoresearch/           # Vendored from autoresearch-spark fork
    prepare.py            # Data download + tokenizer (read-only)
    train.py              # Model + training loop (agent edits this)
    generate.py           # Interactive text generation from checkpoints
    program.md            # Agent instructions / experiment loop
    LEARNINGS.md          # GB10-specific findings (~135 experiments)
    pyproject.toml        # Dependencies (PyTorch cu128)
    uv.lock               # Lockfile
    .python-version
    .gitignore

Key design decisions

• CUDA 13.0 + cu128: GB10 (sm_121a) needs CUDA 13.0's ptxas for Triton, but PyTorch cu128 wheels (cu130 doesn't work yet)
• Vendored code: autoresearch Python files baked into the image so uv sync runs at build time
• Split policies: runtime policy (no PyPI — deps pre-installed) vs dev policy (adds PyPI/PyTorch for iteration)
• Standalone image: parallel to base (not child of it) since it needs a CUDA devel base image

Quick start

openshell sandbox create \
  --remote my-spark \
  --gpu \
  --provider claude \
  --provider github \
  --from autoresearch-spark \
  -- claude