Add Lima sandbox environment for parallel feature testing

Implement a complete sandbox system for testing multiple features in parallel
using git worktrees and Lima VMs. Each worktree gets its own isolated VM with
Docker, full service stack, and unique IP via vzNAT networking.

- contrib/lima/provision.sh: Idempotent provisioning script (Docker, Go 1.26.1, Node.js 24, npm 11.8.0, Go tools, mkcert)
- contrib/lima/probo.yaml: Lima VM template with vz vmType, Rosetta, vzNAT, virtiofs mount
- contrib/lima/sandbox.sh: Lifecycle CLI (create, start, stop, restart, delete, ssh, exec, status, list)
- contrib/lima/README.md: Human documentation with prerequisites, quickstart, troubleshooting
- contrib/claude/sandbox.md: Agent reference doc for sandbox usage patterns
- GNUmakefile: Convenience targets for sandbox.sh commands
- AGENTS.md: Updated reference documentation index

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

contrib/claude/sandbox.md

@@ -0,0 +1,73 @@
+# Sandbox Environments
+
+## When to use
+
+Use a sandbox when you need to:
+- Run `make stack-up` (Docker services: Postgres, SeaweedFS, etc.)
+- Test changes end-to-end with `make dev` or `make test-e2e`
+- Build the full binary with `make build`
+- Run any command that requires Docker or the full service stack
+
+## Quick reference
+
+```bash
+# Create a sandbox (first time only)
+./contrib/lima/sandbox.sh create
+
+# Start an existing sandbox
+./contrib/lima/sandbox.sh start
+
+# Run commands inside the sandbox
+./contrib/lima/sandbox.sh exec -- make stack-up
+./contrib/lima/sandbox.sh exec -- make build
+./contrib/lima/sandbox.sh exec -- make dev
+./contrib/lima/sandbox.sh exec -- make test
+
+# Get the VM IP and service URLs
+./contrib/lima/sandbox.sh status
+
+# Interactive shell
+./contrib/lima/sandbox.sh ssh
+
+# Stop (shutdown — preserves disk and Docker images, but running processes are lost)
+./contrib/lima/sandbox.sh stop
+
+# Delete entirely
+./contrib/lima/sandbox.sh delete
+```
+
+## Accessing services
+
+After `sandbox.sh status`, use the VM IP to access services from the host:
+
+| Service | URL |
+|---|---|
+| Console | `http://<vm-ip>:5173` |
+| API | `http://<vm-ip>:8080` |
+| Grafana | `http://<vm-ip>:3001` |
+| Mailpit | `http://<vm-ip>:8025` |
+| Keycloak | `http://<vm-ip>:8082` |
+| PostgreSQL | `psql -h <vm-ip> -U probod` |
+
+## Common workflows
+
+**Build and test:**
+```bash
+./contrib/lima/sandbox.sh exec -- make stack-up
+./contrib/lima/sandbox.sh exec -- make build
+./contrib/lima/sandbox.sh exec -- make test
+```
+
+**Run e2e tests:**
+```bash
+./contrib/lima/sandbox.sh exec -- make stack-up
+./contrib/lima/sandbox.sh exec -- make test-e2e
+```
+
+**Restart after code changes:**
+Code changes are reflected immediately (virtiofs mount). Just re-run the
+relevant make target — no need to restart the VM.
+
+```bash
+./contrib/lima/sandbox.sh exec -- make dev
+```