feat: authenticate interpreter requests with in-memory token verifiers

[devin-ai-integration]

Summary

Authenticate interpreter requests locally with an in-memory SHA-512 verifier delivered by envd over a root-only Unix socket. Reject requests before provisioning or after disconnect, update verifiers on resume/fork, and keep /health credential-free but unavailable until the verifier feed connects. Tokenless sandboxes cannot execute code; only explicit local Docker development (E2B_LOCAL=true) bypasses auth.

Token authentication only: Jupyter isolation is now the independent #343. Both target main and share the server-test harness; this PR leaves Jupyter's TCP listener unchanged and does not secure direct Jupyter access.

Deploy https://github.com/e2b-dev/belt/pull/4368 and release e2b-dev/E2B#1955 before rebuilding this template. Older envd cannot satisfy the health check; the template CI build remains gated on that provider rollout. Related: https://linear.app/e2b/issue/SDK-363/verify-code-interpreter-context-endpoint-auth-requirements

Verification: all 9 authentication tests pass on Python 3.10 and 3.12 after the split; Ruff lint/format and Python compilation pass. Coverage includes endpoint rejection, verifier rotation/reconnect, malformed delivery, health semantics, and public WebSocket rejection. Actual Firecracker resume/fork/live-upgrade testing is still required before rollout.

Link to Devin session: https://app.devin.ai/sessions/23861bced08343e59c14adf841498b12
Open in Devin Desktop: https://app.devin.ai/desktop/session/23861bced08343e59c14adf841498b12?variant=devin
Requested by: @mishushakov

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

The template build reached the readiness check but /health never became ready and timed out after 10 minutes. This is consistent with the rollout prerequisite above: the new health check intentionally requires envd's private verifier connection. A production code-interpreter-v1 sandbox currently reports envd 0.6.10 and has no /run/e2b-auth/token.sock; the required provider is in https://github.com/e2b-dev/belt/pull/4368.

The CI log does not include service journals, so this is not a complete diagnosis of that build. Local tests cover the missing-feed 503 and healthy-connected 200 behavior. Keep this draft and rerun the template build after the envd provider is deployed; do not bypass authentication or weaken readiness to make the build pass.

[devin-ai-integration]

Closed at Mish's request; replaced from main by #346 using envd HTTP token verification with a five-second in-memory success cache. Jupyter isolation remains in merged #343.