fix(harness): bind RuntimeContext before sandbox start

[yujianxin991]

Summary

• add a backward-compatible Sandbox.bindRuntimeContext(RuntimeContext) lifecycle hook
• invoke it after acquire and before start for every sandbox path
• verify binding order and cleanup when binding fails

Motivation

Sandbox implementations may need the per-call user/session identity before start creates or resumes remote resources. Previously RuntimeContext was available to SandboxLifecycleMiddleware but was not passed to Sandbox until exec, which is too late for ownership and isolation metadata.

Testing

• mvn -pl agentscope-harness -am -Dtest=SandboxLifecycleMiddlewareRuntimeContextTest,SandboxLifecycleMiddlewareCallbackTest -Dsurefire.failIfNoSpecifiedTests=false test

6 focused tests passed.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!