Run a command in a sandbox

Creates a new workspace in the same project that starts as a copy of this one at a durable checkpoint: its disk and memory, uncommitted work included. checkpointId defaults to the workspace's head. The fork starts asleep with one stopped execution; the first attach wakes it. It gets its own git branch, remotehost/<name>; nothing is pushed. Needs sandbox.create and sandbox.destroy on the project, and only the workspace's owner may fork it (403 workspace_owner_only). A checkpoint that is not durable yet is refused with 409 checkpoint_not_durable, one of another workspace with 404 checkpoint_not_found, a checkpoint whose saved state is no longer in storage with 409 checkpoint_unavailable, a workspace that is not active or sleeping with 409 workspace_unavailable, and a workspace with no checkpoint at all with 409 nothing_to_fork. The fork keeps the source's lifetimePolicy and has no expiresAt. Off unless the server enables it; while off the route answers 404. A workspace with a work volume is forked with a copy of that volume. A running workspace's volume is committed first, so the copy holds every write made before the fork was asked; a commit that fails or does not answer in time is refused with 409 workspace_unavailable. A fork at a named checkpoint is refused with 409 checkpoint_volume_moved once the volume has changed since that checkpoint, as is a fork of a workspace that is stopping. A copy smaller than 4096 bytes is refused with 409 work_volume_too_small. The copy is refused as a volume create is (409 volume_limit_exceeded, 429 rate_limited, 404 not_found), and with 503 volume_service_unavailable when the volume service does not answer.