Summary

• add per-user vault routing and actor-aware execution resolution
• split sandbox implementations into host/container/image/firecracker modules and add managed image sandbox lifecycle support
• separate operator state into --state-dir, add vault/binding stores, and wire event routing through creator userId
• include the base web /login flow needed to populate vault credentials for the new runtime model

Validation

• npm test
• npm run build