Add a CodeAct context provider

[shibayan]

Priority

P3

Goal

Provide a reusable CodeAct execution provider with explicit safety and isolation boundaries.

Scope

• Define code-generation and execution lifecycle contracts.
• Support a pluggable sandboxed executor.
• Enforce timeout, resource, output, and capability limits.
• Capture execution results and telemetry for agent context.
• Add security-focused tests, documentation, and a sample.

Acceptance criteria

• Generated code never executes outside the configured sandbox abstraction.
• Timeout, cancellation, output truncation, and execution failures are deterministic.
• No ambient credentials or filesystem access are exposed by default.
• The executor is replaceable and testable without running untrusted code.
• Documentation clearly states the security model and non-goals.

Dependency

Uses the common hosted execution context for cancellation, identity, and tracing.