feat(sandbox): add RemoteOperator with SandboxNextProvider

[Generalwin]

Summary

Add a new remote operator type for integrating with remote sandbox platforms via HTTP REST API. This follows the same Provider abstraction pattern as K8sOperator (K8sProvider Protocol + BatchSandboxProvider).

resolves #1330

Changes

New files

• rock/sandbox/operator/remote/ — RemoteOperator module (operator, provider Protocol, constants, SandboxNextProvider)
• tests/unit/sandbox/operator/remote/ — 43 unit tests (mock httpx MockTransport + AsyncMock provider)
• docs/proposals/remote-operator.md — Design document
• docs/proposals/sandbox-next.yaml — SandboxNext Gateway OpenAPI spec

Modified files

• rock/config.py — Add RemoteOperatorConfig (endpoint, api_key, region, sandbox_class, etc.)
• rock/sandbox/operator/factory.py — Extend OperatorContext with remote_config, add "remote" branch to OperatorFactory
• rock/admin/main.py — Pass remote_config=rock_config.remote to OperatorContext
• CLAUDE.md — Update module map

Design highlights

• RemoteProvider Protocol: Lifecycle methods (submit/get_status/stop/delete) + optional Template API (create/get/delete). Provider stays pure — no Redis dependency.
• SandboxNextProvider: Uses httpx.AsyncClient, 5xx exponential backoff retry (max 3), 4xx immediate return. State mapping table (SandboxNext → Rock State), configurable.
• RemoteOperator: Thin wrapper delegating to provider. get_status merges Redis user metadata with provider real-time status. Template API catches NotImplementedError → BadRequestRockError.
• Data plane: host_ip = endpoint_template string directly, port_mapping hardcoded {PROXY: 8000, SERVER: 8080, SSH: 22} (same as K8s). Reuses SandboxProxyService (Rocklet RPC).
• Stop semantics: pause 501 → fallback to delete.
• No Ray dependency: operator_requires_ray("remote") → False. operator_supports_scheduler("remote") → False.

Test plan

• 43 unit tests pass (pytest tests/unit/sandbox/operator/remote/ -v)
• CI python-ci workflow passes
• Integration test with real SandboxNext endpoint (future)