Read Provider declarations in Web

[SaladDay]

Web now branches on what each Sandbox Provider declares, not on its name.

• DeploymentPolicy moves into the Provider protocol file (sandbox_provider.go) and gains the adapter's default sandbox size. Docker declares 2 CPU / 2048 MiB, microsandbox 2 / 4096 / 8192 / 8192, and E2B none, since its template sets the size. Registration checks that a declared default passes the adapter's own ValidateResources.
• Registry.DeploymentContract() builds one contract, and cmd/specification-contract writes it to both node_spec.py and packages/agents-client/src/deployment-contract.ts. Each provider entry carries mode, disk, runtime and default_resources. SandboxProvider is derived from the generated keys; the hand-copied union, the providers Set and standard-sizes.json are deleted.
• For a saved deployment, Web reads deployment.mode and deployment.suspension. For a choice not yet saved, it reads the generated entry. Host requirements are one Provider-neutral line, because the installer already checks them. Remaining name comparisons are display labels, the E2B wizard step and the Docker confirmation, both deferred until the Provider protocol declares configuration fields.
• Docs: sandbox-provider.md (en and zh) describes the declaration and its projections and narrows the known gap to the wizard exception.

Checks: go build, go vet, the Go tests for sandbox/..., deployment/... and cmd/specification-contract; the projection is stable (-write twice, no diff); agents-client typecheck and tests; Web typecheck and the focused vitest files; translation and link checks; check-names. Playwright is left to CI.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}