integrations/nemo-gym: NeMo Gym sandbox provider built on the Python client

[Tomer Glottmann (tomergee)]

What

A NeMo Gym sandbox provider that runs rollout sandboxes as ate-env environments, under integrations/nemo-gym/. It registers through the nemo_gym.sandbox_providers entry point, so Gym-based frameworks (NeMo-RL, Nemotron pipelines) select it with a sandbox: substrate: config block and nothing else changes.

It is a thin adapter over clients/python (ate_env):

Provider call	What it does
create(spec)	Client.create with the template's atespace, then Env.shell("true") until the guest answers, then Env.write_file for spec.files
exec(cmd, cwd=, env=, timeout_s=)	Env.start_process(["sh","-c",cmd], cwd, env) + stream_outputs + wait; the deadline is also enforced guest-side with timeout(1), and on the client-side deadline the process is killed before a -1 sentinel result is returned
upload_file / download_file	Env.write_file / Env.read_file_bytes
status(handle)	Client.get, so polling never wakes a parked actor. Suspended and paused report RUNNING because the router resumes them on the next command; RESUMING is STARTING, CRASHED is ERROR, gone is STOPPED
close(handle)	Client.delete, NOT_FOUND-safe

Config follows ate-env vocabulary (create.atespace, namespace kept as an alias; defaults default-template in ate-env). An https:// api_url opens a TLS channel; a caller-owned ate_env.Client can be passed in.

Why here

The provider was developed in the substrate repo's demos tree against an earlier ate-env (HTTP guest proxy, ateenv.v1 stubs). Everything it depends on now is this repo: the v1alpha API, the Python client, and the guest image. So it moves here and drops the vendored stubs.

Testing

• make nemo-gym-test: 35 contract tests run the real ate_env client against an in-process fake of the three services (tests/fakes.py). No cluster, no nemo-gym needed (base types fall back to structural mirrors; with nemo-gym installed the same tests run against the real types).
• tests/test_e2e.py runs the full lifecycle on a real actor when SUBSTRATE_E2E_API_URL points at an ate-env-api. Not yet run since the port to the gRPC data plane; the README's benchmark numbers are marked as measured on the earlier HTTP path.
• hack/verify/boilerplate.sh passes.

Also in this PR

• Root README: the integration under the layout list and the Examples section.
• Makefile: nemo-gym-test.
• integrations/nemo-gym/hack/bake-task-image.sh builds the guest from this checkout by default; the README also shows the OCI image-volume way to add the guest to an unmodified task image, which is the shape the SWE-500 benchmark uses.

Follow-up

A task-image mode for ate-env templates (guest injected as an image volume) and CreateEnvironment from an image, so the provider's image_templates map stops being a manual step.

[Sunny (sunnylovestiramisu)]

/lgtm