feat: add remote workspaces and verified deliverables

tests/test_docker_workspace.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
 import asyncio
+import io
 import os
+import tarfile
 from dataclasses import replace
 
 import pytest
@@ -23,6 +25,14 @@ async def test_real_docker_workspaces_are_isolated(settings) -> None:
         second = await provider.read_file(users[1], "secret.txt", 1, 10)
         assert "only-a" in first.output and "only-b" not in first.output
         assert "only-b" in second.output and "only-a" not in second.output
+        listing = await provider.browse_files(users[0], ".")
+        assert {entry.name for entry in listing.entries} >= {"secret.txt"}
+        download = await provider.download_file(users[0], "secret.txt")
+        assert download.content == b"only-a"
+        archive = await provider.archive_files(users[0], ".")
+        archive_bytes = b"".join(archive.chunks or ())
+        with tarfile.open(fileobj=io.BytesIO(archive_bytes), mode="r:gz") as workspace_tar:
+            assert any(name.endswith("secret.txt") for name in workspace_tar.getnames())
         escaped = await provider.exec(users[0], "test ! -e /var/run/docker.sock", ".", 10)
         assert escaped.ok