docs: document key setup and move sandbox steps into scripts

[Ho1yShif]

Summary

Move the long shell blocks into scripts, document how to create each key, and change the license holder to Render.

 scripts/
+├── create_sandbox.sh   # asks for the environment key, prints the sandbox ID
+├── stage.sh            # installs the executor, copies fixture/ to /workspace
+└── verify.sh           # restores inputs, runs tests and verify.mjs, downloads results

README changes:

• Add an ASCII diagram that shows what runs on your machine, in the sandbox, and at OpenAI.
• Use the OpenAI dashboard labels for key permissions (Agents: Write, Responses: Write). Call the second key "environment key" in all places.
• Show a Python block and then a TypeScript block for each client step, in place of the command tables.
• Replace the long shell blocks with one script call each. Remove the umask 077 step.
• Link to the Render Dashboard and the cleanup section at the point where cleanup becomes necessary.

Decisions:

• create_sandbox.sh writes the key file with mktemp outside the repo and deletes it in a trap. The README no longer has an rm -f executor.env step.
• The scripts find files from their own location, so they work from any directory. Results now go to results/ at the repo root.
• The script gets the sandbox ID with a Bash regex on the JSON output, so jq is not required.
• The README links to the dashboard root. The Render docs do not give a sandboxes page URL.

Multi-file upload

render ea sandboxes copy takes one path per call, so verify.sh runs three copies. Release notes for CLI 2.28.0 and 2.29.0 show no changes to copy. Other products batch uploads in their SDKs:

• Vercel Sandbox writeFiles([{ path, content }]), docs
• E2B files.write([{ path, data }]), docs
• Daytona fs.upload_files([...]), docs

copy uploads a directory as one archive, so a later change could stage the verify files in one directory and copy them with one call. This PR does not make that change.

Evidence

• shellcheck scripts/*.sh reports no issues.
• With a fake render on PATH, under Bash 3.2, run from / and /tmp:
  • create_sandbox.sh prints only sbx-abc123 on stdout.
  • The key file has mode 600 while the CLI reads it, and it is deleted after success and after a CLI failure.
  • An empty key or a key with a space exits 1.
  • stage.sh and verify.sh exit 1 with Set SANDBOX_ID first. when SANDBOX_ID is not set. They call the CLI with absolute repo paths when it is set.
• python -m pytest -q passes (24 tests).

Merge Danger

Door: two-way

Blast Radius: docs

Python writes session.json with mode 600 only after #2 merges. Merge that PR before this one, or put the umask 077 step back.

🤖 Generated with Claude Code