smolvm

Run fh add smolvm. The versioned recipe creates a managed RemoteSandboxApi adapter and its contract test. Map the current smolvm client into Fabric's shell, binary file, working-directory, environment, timeout, cancellation, and cleanup operations.

Keep credentials at the trusted runtime boundary. Declare the actual filesystem, process, and network isolation the provider supplies; apply Fabric capability policy as an additional boundary. Only emit a portable sandbox reference when a different process can securely reconnect to the same VM. Run validateSandboxAdapter() and a real create/execute/abort/cleanup smoke before production.