Make remote validation fast and workload-aware across Blacksmith and Crabbox

Problem

Remote validation currently has no bounded workload policy across Blacksmith Testbox, Daytona, Azure, and AWS. CI dispatches also repeat dependency setup and can retain SSH sessions after cancellation, which makes fast checks slow and leaves capacity looking busy.

Intended behavior

• Blacksmith remains the primary trusted CI/check provider without a large permanent warm pool.
• Daytona is a brokered fallback while its performance is measured.
• Azure and AWS are the final brokered fallbacks.
• Explicit provider choices remain explicit.
• Cloud provider credentials are not required in the OpenClaw checkout; cloud execution authenticates through Crabbox.
• Untrusted workloads stay on isolated cloud paths until Daytona isolation has live proof.
• Testbox dependency state is reused and task-owned SSH sessions close promptly on teardown.

Evidence

Live audit on July 31, 2026 found high Blacksmith cancellation volume, repeated dependency hydration, and authenticated SSH sessions persisting after stopped Testboxes. Focused implementation and remote Testbox proof are being prepared on separate routing and lifecycle branches.