Publish CyberGym-E2E E2B adapter

[mattteufel-e2b]

Summary

• publish the standalone CyberGym-E2E E2B adapter from a curated allowlist
• keep Template recipes, names, build receipts, and runtime image selection content-addressed
• resolve and strictly validate the complete mutable upstream image inventory before execution
• package runtime policies, remote helpers, compatibility patch, upstream lock, and dependency lock
• exclude credentials, gated data, vendored upstream source, campaign selections, reports, reducers, raw trajectories, and account-scoped manifests

Verification

• Python 3.12 and 3.13: 42 tests pass
• Ruff lint and formatting pass
• wheel, sdist, Twine, installed-wheel, and extracted-sdist checks pass
• public-tree policy, actionlint, diff checks, and full proposed-history Gitleaks pass
• independent release review approved exact head d0ca707

Outstanding external validation

This PR intentionally does not claim live validation. Registry resolution of the real 506 mutable image tags, upstream network synchronization, E2B Template builds, and live task smoke remain outstanding. Do not merge until maintainers review those release gates.