fix: run sandbox image as workspace owner

[cmpadden]

Summary

Closes #1596. The published sandbox image gives /workspace to vercel-sandbox but currently runs commands as root, causing GitHub channel checkout to fail Git's ownership check. The image now runs as its workspace owner, preserving passwordless sudo for privileged setup instead of weakening safe.directory; the image analysis job executes the failing Git sequence as a regression test, and the sandbox bootstrap example uses sudo accordingly.

Existing durable sandboxes are not rotated, so they retain their current process user and workspace state; the fix applies when a sandbox is provisioned from the updated image. This draft reaches the same core image-user correction as #1692 and adds executable image coverage and the corresponding documentation update.

Validation

• pnpm docs:check
• pnpm guard:invariants
• pnpm exec oxfmt --check .github/workflows/docker-image-size-analysis.yml docs/sandbox.mdx
• git diff --check
• Docker was unavailable locally; the added CI smoke test builds and runs the candidate image
• Changeset not applicable: this does not modify the published eve package

Checklist

• I linked an issue with prior discussion confirming this change is wanted
• I ran the relevant checks from CONTRIBUTING.md
• I added tests and documentation where relevant
• I added a changeset if this touches the published eve package
• DCO sign-off passes for every commit (git commit --signoff)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview	Aug 10, 2026 3:27pm
eve-docs-4759	Ready	Preview, v0	Aug 10, 2026 3:27pm

[github-actions]

Docker Image Size Summary: Dockerfile

Key takeaways

• Image size is unchanged vs main (8bb2977).

Delta vs main (8bb2977)

Metric	Baseline	Current	Delta
Image size	583.31 MB	583.31 MB	0 B

Metadata

• Current: pull request (17aea27)
• Generated at: 2026-08-10T15:27:14.747Z