feat: multi-user support in sandboxes

[Tyler Payne (tylerpayne)]

Summary

Adds OS-user management to the Quicksand API so multiple isolated users can share one VM.

• Sandbox.create_user(name) returns a SandboxUser handle (uid, gid, home) and Sandbox.delete_user(name, remove_home=...) kills the user's processes and removes the account. Sandbox.execute(..., user=...) (or SandboxUser.execute) runs commands with that user's uid/gid/supplementary groups and HOME, defaulting cwd to the user's home.
• The guest agent manages accounts by writing /etc/passwd, /etc/group, and /etc/shadow directly, so behaviour is identical on Alpine, Ubuntu, and any other guest with no dependency on adduser/useradd. Privileges drop via initgroups/setgid/setuid in a pre_exec hook. Account-file mutations are serialised behind a mutex, and usernames are validated to prevent injection into the colon/newline-delimited files.
• Both transports (HTTP and virtio-serial) expose create_user/delete_user and the user field on execute/execute_stream.
• Because the Dockerfiles compile the agent from a build-context copy that the Dockerfile text does not reference, the image cache key now folds in a hash of the agent source, with a .buildhash sidecar validating caller-supplied output paths. The ubuntu hatch hook always delegates to build_image so an agent-only change rebuilds the packaged image instead of shipping a stale qcow2.

Also includes one standalone build fix. The quicksand-qemu wheel hardcoded manylinux_2_17, letting pip install wheels whose bundled binaries need a newer glibc than the host and then crash on load. The manylinux tag is now derived from the glibc symbol versions the bundled ELF binaries actually reference (via auditwheel, a new Linux-only build dependency).

Fixes applied during review

• Resolved leftover merge conflict markers in the guest agent (Cargo.toml, main.rs). The multiuser changes predated the virtio-serial writer-task refactor, so they were ported onto it: handlers emit frames through send_frame and commands still run on spawned tasks so a long command cannot stall the read loop.
• The image cache sidecar check now only applies to caller-supplied output paths. The default custom-<hash>.qcow2 name already encodes the input hash, so requiring a sidecar there needlessly invalidated existing caches.
• Updated test fakes to match the new execute signature and the cache-key test to include the agent source hash.

Testing

• cargo check and cargo clippy clean on the guest agent (the two clippy warnings are pre-existing).
• 305 unit tests pass, including 6 new tests covering user threading into execute params, SandboxUser handle routing, and error propagation.
• ruff check, ruff format, and ty check all pass.

🤖 Generated with Claude Code