replacing #16 for adding islo.dev support with Go SDK

Summary

Adds provider: islo to crabbox, driven by the islo Go SDK. No islo CLI required. Auth via ISLO_API_KEY; the SDK's NewIslo handles API-key → JWT exchange and auto-refresh.

export ISLO_API_KEY=ak_...
crabbox warmup --provider islo
crabbox run    --provider islo --id <sandbox> -- pnpm test
crabbox status --provider islo --id <sandbox> --wait
crabbox list   --provider islo --json
crabbox stop   --provider islo <sandbox>

Mapping

Why a custom SSE consumer

The SDK's Sandboxes.ExecInSandboxStream returns interface{} via the standard JSON caller.Call — it buffers the SSE body and decodes, so callers don't see live deltas. Until the SDK exposes a streaming iterator, internal/cli/islo.go issues the streaming request directly. Auth (customauth.Provider), base URL, and token refresh still come from the SDK, so behavior stays in lockstep with NewIslo. The wire format observed against api.islo.dev is plain SSE (event: stdout|stderr|exit, one or more data: lines, blank-line terminator); parseIsloSSE follows the spec including multi-line data: joining and the leading-space strip.

Mirrors the blacksmith pattern

• IsloConfig struct + islo: YAML block + CRABBOX_ISLO_* env overrides
• --islo-image, --islo-workdir, --islo-gateway-profile flags on warmup/run
• Lease IDs of the form isb_<sandbox-name> in the existing claim store; reuses claimLeaseForRepoProvider, removeLeaseClaim, newLeaseSlug, resolveLeaseClaim unchanged
• serverTypeForConfig / serverTypeForProviderClass return "" for islo
• Dispatch sites in run.go, pool.go, status.go, capabilities.go, target.go, screenshot.go, vnc.go add isIsloProvider next to existing isBlacksmithProvider checks

Tests

Hand-rolled fake IsloClient (interface seam) drives unit tests for warmup, run, streaming output, exit-code propagation, list (text + JSON), status wait, status timeout, stop, auth-failure surfacing, lease-ID resolution, and SSE parsing. config_test.go extended with islo YAML + CRABBOX_ISLO_* env assertions.

Live verification (against api.islo.dev)

• go vet ./...
• gofmt -l $(git ls-files '*.go') clean
• go test -race ./...
• go build -trimpath -o bin/crabbox ./cmd/crabbox
• node scripts/check-docs-links.mjs and node scripts/check-command-docs.mjs pass
• Core coverage gate: 86.1% (above 85%)
• crabbox warmup --provider islo — sandbox created, lease + slug printed
• crabbox status --provider islo --id <sandbox> --wait — polled to running
• crabbox run --provider islo --id <sandbox> -- echo hello — streamed stdout
• crabbox run --provider islo --id <sandbox> -- bash -lc '...; sleep 1; ...; exit 7' — interleaved stdout/stderr arriving live; exit code 7 propagates as ExitError{Code: 7}
• crabbox list --provider islo --json — sandbox visible with running status
• crabbox stop --provider islo <sandbox> — sandbox released, claim removed
• Negative: missing ISLO_API_KEY → exit 2 with actionable message
• Negative: --desktop → exit 2 (islo sandboxes are headless)
• Negative: --sync-only → exit 2 (sync is delegated)

Follow-ups (not part of this PR)

• File against go-sdk: expose Sandboxes.ExecStream(ctx, ...) <-chan ExecLogLine (or similar) so the custom SSE consumer here can be deleted.
• The islo runner emits a trailing ANSI clear-screen sequence at the end of each exec; harmless but visible. Worth raising upstream.

🤖 Generated with Claude Code