Add app-owned sandbox and platform sidecar ideas - #65

Summary

• propose a stateless localhost OpenSandbox compatibility facade backed by CAPI
• propose BOSH-packaged, platform-provided opt-in application sidecars
• explore applications as CAPI principals via the UAA mTLS-to-JWT flow
• propose durable app-owned CAPI sandbox resources with evacuation snapshot options

Notes

• each idea includes a Mermaid diagram and links to the other ideas
• workspace-only, full writable-rootfs, and hybrid snapshot models remain explicit research options

Validation

• python .github/scripts/validate_notes.py
• python scripts/summarize_ratings.py --check
• python -m unittest discover -s tests
• python scripts/generate_research_map.py
• git diff --exit-code -- generated/research-map.html