fix(sandbox): pass explicit user to docker exec for UID-mapped containers

After tai sandbox containers start as root with dynamic UID mapping,
docker exec defaults to root. Add User field to ExecOptions and
hardcode "sandbox" in Box.Exec/Stream to ensure commands run as the
correct user.

Made-with: Cursor

sandbox/v2/box.go

@@ -93,6 +93,7 @@ func (b *Box) Exec(ctx context.Context, cmd []string, opts ...ExecOption) (*Exec
 	result, err := res.Runtime.Exec(ctx, b.containerID, cmd, tairuntime.ExecOptions{
 		WorkDir: cfg.WorkDir,
 		Env:     cfg.Env,
+		User:    "sandbox",
 	})
 	if err != nil {
 		return nil, err
@@ -123,6 +124,7 @@ func (b *Box) Stream(ctx context.Context, cmd []string, opts ...ExecOption) (*Ex
 	handle, err := res.Runtime.ExecStream(ctx, b.containerID, cmd, tairuntime.ExecOptions{
 		WorkDir: cfg.WorkDir,
 		Env:     cfg.Env,
+		User:    "sandbox",
 	})
 	if err != nil {
 		return nil, err

tai/runtime/docker_core.go

@@ -106,6 +106,7 @@ func (d *dockerCore) exec(ctx context.Context, id string, cmd []string, opts Exe
 		Cmd:          cmd,
 		WorkingDir:   opts.WorkDir,
 		Env:          envSlice(opts.Env),
+		User:         opts.User,
 		AttachStdout: true,
 		AttachStderr: true,
 	}
@@ -143,6 +144,7 @@ func (d *dockerCore) execStream(ctx context.Context, id string, cmd []string, op
 		Cmd:          cmd,
 		WorkingDir:   opts.WorkDir,
 		Env:          envSlice(opts.Env),
+		User:         opts.User,
 		AttachStdin:  true,
 		AttachStdout: true,
 		AttachStderr: true,

tai/runtime/sandbox.go

@@ -70,6 +70,7 @@ type ContainerInfo struct {
 type ExecOptions struct {
 	WorkDir string
 	Env     map[string]string
+	User    string // container exec user; empty = container default (container.Config.User)
 }
 
 // ExecResult holds output from an exec command.