feat(agent): Sandbox Support for Antigravity CLI (agy)

[Shiritai]

Resolves #16

📝 Description

Google recently released a standalone command-line version of Antigravity (agy). The official installation involves executing a bootstrap script that drops a binary in $HOME/.local/bin/agy and frequently reads/writes to staging caches in the background. It also performs background self-updates.

To ensure developers' host environments remain pristine and to avoid side effects, this PR brings the agy workload under sanity-gravity management.

Thanks to the newly merged Microkernel Plugin Architecture (#PR_NUMBER), introducing this entire feature required zero changes to core Python code.

✨ Key Changes

1. New Agent Plugin (agy)

   • Added a new manifest.toml and Dockerfile inside plugins/agents/agy/.
   • The manifest declares no capability requirements (requires = []), so the capability solver admits the plugin under both xfce and none desktops — yielding agy-xfce-{kasm,vnc,ssh} and the headless agy-none-ssh variant (same shape as cc-none-ssh / gc-none-ssh).
   • The Dockerfile cleanly installs agy globally to /usr/local/bin/agy during the build phase (using the installer's -d flag to override its default $HOME/.local/bin destination), bypassing the messy $HOME bootstrap process and ensuring it works universally regardless of the container user's UID.

2. Relaxed Test Bounds

   • Adjusted test_cli_unit.py and test_plugin_registry.py. Previously, they used rigid exact equality checks (==) for the number of built-in tags. They have been updated to use subset (.issubset()) and minimum bounds (>=), ensuring that the test suite does not break when new valid plugins like agy are added dynamically.

✅ Verification

• Successfully rebased on top of the latest main branch.
• All unit tests pass, confirming that the new dynamic plugin registration handles agy correctly.
• Confirmed volume isolation correctly keeps agy caches strictly inside the container's persistent volume (e.g. sg-<project>-agy-none-ssh), leaving the host completely unaffected.

🚀 How to Test

1. Rebuild the image:

   ./sanity-cli build -v agy-none-ssh

2. Start the sandbox:

   ./sanity-cli up -v agy-none-ssh

3. Enter the sandbox and verify agy works:

   ./sanity-cli shell -v agy-none-ssh
   agy --version