feat(sandboxed-gym): Install dependencies from wheels in Gym host runtime

[JashG]

Summary

Adds wheels-v1 dependency installation to the sandboxed Gym host runtime. Before Gym starts, the runtime installs vendored wheels from the read-only environment mount into writable job storage and ensures Gym’s per-server environments resolve their requirements from those wheels without accessing a package index.

This PR depends on #1400.

Changes

Runtime behavior

• Detect nemo-environment.yaml manifests using the wheels-v1 format. Install wheels from the read-only environment mount into writable job storage before Gym starts.
• Expose installed packages to the running host through sys.path and to child processes through PYTHONPATH.
• Set UV_FIND_LINKS and UV_NO_INDEX so Gym’s per-server environments resolve their requirements.txt dependencies exclusively from the staged wheelhouse.
• Preserve existing behavior for environments without a manifest or using another format.

Runtime dependencies

• Add a sandboxed-gym[runtime] extra containing PyYAML.
• Install PyYAML in the development Gym host image.

Test coverage

• Add unit tests for manifest handling, missing wheels, installation arguments, offline uv configuration, import-path propagation, and bootstrap ordering.
• Add a lightweight integration test that creates a real wheel locally and invokes the real uv executable without Docker or external package downloads.
• Verify the installed package is importable by the running host and a child process.
• Verify a simulated Gym per-server requirements.txt installation resolves from the staged wheelhouse with package-index access disabled.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Documentation updated for user-visible behavior
• Documentation not applicable — justification: This PR implements the internal M2a runtime installation step. Wheel-bundle production, staging, and broader component coverage are handled separately.

Verification

• Pull request title follows the repository's Conventional Commit format
• Every commit includes an appropriate Signed-off-by: trailer
• uv run pre-commit run -a passes, or any blocked checks are identified below
• Targeted tests pass, or tests are marked not applicable above
• No secrets, API keys, or credentials are included

Targeted validation:

• uv run --project packages/sandboxed_gym --extra dev pytest packages/sandboxed_gym/tests/test_gym_host_runtime.py packages/sandboxed_gym/tests/test_wheels_v1_install_integration.py -q
  • Result: 25 passed
• uv run ruff check packages/sandboxed_gym/src/sandboxed_gym/runtime/gym_host_runtime.py packages/sandboxed_gym/tests/test_gym_host_runtime.py packages/sandboxed_gym/tests/test_wheels_v1_install_integration.py
  • Result: passed
• uv run ruff format --check packages/sandboxed_gym/src/sandboxed_gym/runtime/gym_host_runtime.py packages/sandboxed_gym/tests/test_gym_host_runtime.py packages/sandboxed_gym/tests/test_wheels_v1_install_integration.py
  • Result: passed; all three files already formatted
• uv run pre-commit run -a
  • Relevant checks passed, including Ruff, formatting, type checking, lock drift, configuration checks, and copyright headers.

[JashG]

pyyaml is for parsing the nemo-environment.yaml file.