Sandboxes

Resource caps, binds, and idle behavior for the owner Computer.

CPU/memory/pids via docker update + openclaw.json. Workspace bind at /owner (not reserved /workspace). Snapshots and attachments documented under Computer.