fix(sandbox): use an ephemeral root for Blaxel DAX

[SystemSculpt]

Summary

• Give Blaxel DAX an 8 GiB ephemeral root mounted at /.
• Require dedicated BL_DAX_API_KEY and BL_DAX_WORKSPACE credentials without a TTI fallback.
• Keep the existing pooled Blaxel TTI configuration unchanged.
• Make DAX disk accounting portable across GNU and BusyBox du.
• Honor the workflow's single-provider dispatch input.

Why

DAX materializes several GiB on the writable root. A memory-backed root reduces the memory available to the workload and can cause an OOM during type checking.

The dedicated root keeps workspace data off RAM. Dedicated credentials also isolate DAX from the pooled TTI workspace.

Validation

• pnpm install --frozen-lockfile
• pnpm typecheck
• pnpm -r --if-present test — 175 passed, 1 skipped
• actionlint .github/workflows/sandbox-dax-benchmarks.yml
• bash -n benchmarks/scripts/dax-benchmark.sh
• ShellCheck for the changed shell behavior
• Live Blaxel DAX run from this branch:
  • all 7 phases completed;
  • 8 logical CPUs and 16 GiB memory;
  • 8 GiB ephemeral root mounted at /;
  • disk measurements populated after clone, install, and typecheck;
  • zero sandboxes and persistent volumes after cleanup.

Before merge

The benchmark vault must contain non-empty BL_DAX_API_KEY and BL_DAX_WORKSPACE entries. The Blaxel job fails closed when either entry is missing.

[open-cla]

Contributor License Agreement

All contributors are covered by a CLA.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.