fix(sandbox): migrate ECS config to the #1708 decoupled provider pattern

Rebased onto main, which merged #1708 (decouple sandbox provider config from the
agent config). Align the ECS Fargate provider with that pattern:

- Add a standalone provider config
  nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml -- a top-level
  `sandbox` block selected via `sandbox_provider: sandbox`, matching
  opensandbox/apptainer. Region-only; task cpu/memory/disk come from
  sandbox_spec.resources.
- Drop the agent-coupled configs/mini_swe_agent_ecs_fargate.yaml; the generic
  mini_swe_agent_2.yaml now runs on ECS by adding the provider config path.
- Bump the generic config's sandbox_spec.resources.disk_gib 20 -> 30 so it is
  valid on every provider (Fargate rejects an explicit 20; 21-200 only).
- Update the ECS Fargate docs (Fern page + agent README) to the config-paths recipe.
- Reconcile uv.lock (boto3 / botocore, sandbox extra) after the rebase.

Signed-off-by: Michal Bien <mbien@nvidia.com>

Author: Glorf

fern/versions/latest/pages/infrastructure/sandbox/ecs-fargate.mdx

@@ -20,15 +20,14 @@ uv pip install boto3
 
 ## Provider Configuration
 
-Region-only is enough; everything else auto-discovers from SSM (explicit YAML always wins):
+NeMo Gym ships this provider config at `nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml`. It defines a top-level `sandbox` block that an agent selects with `sandbox_provider: sandbox`. Region-only is enough; everything else auto-discovers from SSM (explicit YAML always wins), and task cpu/memory/disk come from the agent's `sandbox_spec.resources`:
 
 ```yaml
-sandbox_provider:
+sandbox:
+  default_metadata:
+    sandbox-api: ecs-fargate
   ecs_fargate:
     region: ${oc.env:AWS_REGION}
-    cpu: "2048"
-    memory: "8192"
-    ephemeral_storage_gib: 50
 ```
 
 | Field | Default | Purpose |
@@ -106,7 +105,11 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-For an end-to-end agent run, `mini_swe_agent_2` ships a ready config at `responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_ecs_fargate.yaml` that selects this provider with region-only auto-discovery.
+For an end-to-end agent run, add this provider config to `mini_swe_agent_2`'s config paths — the agent config is unchanged:
+
+```bash
+ng_run "+config_paths=[responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_2.yaml, nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml, <MODEL_CONFIG>]"
+```
 
 ## Troubleshooting
 

nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml

@@ -0,0 +1,26 @@
+# ECS Fargate sandbox provider config.
+#
+# `sandbox` is the instance name an agent references via `sandbox_provider: sandbox`;
+# the child key `ecs_fargate` selects the provider and its value is passed to the
+# provider constructor. Every shipped provider config binds the same name `sandbox`,
+# so swapping providers is swapping this config path in `+config_paths` (no agent edit):
+#
+#   AGENT=responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_2.yaml
+#   MODEL=responses_api_models/vllm_model/configs/vllm_model.yaml
+#   ng_run "+config_paths=[$AGENT, nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml, $MODEL]"
+#
+# Requires AWS credentials (AWS_REGION + access keys or an instance role) and the `sandbox`
+# extra (boto3). See the ECS Fargate provider page under infrastructure/sandbox for setup
+# (SSM infrastructure, the :52222 network requirement, and on-demand image mirroring).
+#
+# `default_metadata` (optional) is merged into every sandbox's spec metadata
+# (SandboxSpec.metadata); an agent's own sandbox_spec.metadata overrides it.
+sandbox:
+  default_metadata:
+    sandbox-api: ecs-fargate
+  ecs_fargate:
+    # Region-only: cluster / subnets / security-groups / roles and the SSH-sidecar key ARNs
+    # auto-discover from SSM (/<ssm_project>/ecs-sandbox/config; ssm_project defaults to harbor).
+    # Task cpu / memory / disk come from the agent's sandbox_spec.resources (mapped onto the
+    # Fargate task); set cpu / memory / ephemeral_storage_gib here only to change the defaults.
+    region: ${oc.env:AWS_REGION}

responses_api_agents/mini_swe_agent_2/README.md

@@ -487,11 +487,11 @@ Kubernetes wrapper, add any outer per-sample guard there.
 
 ## Running SWE-bench on ECS Fargate
 
-Swap OpenSandbox for ECS Fargate by using
-`configs/mini_swe_agent_ecs_fargate.yaml` — the agent loop and SWE-bench
-verifier are unchanged. For provider setup (AWS infra/SSM, credentials, the
-`:52222` network requirement, and automatic image mirroring via `auto_mirror`)
-see the [ECS Fargate provider README](../../nemo_gym/sandbox/providers/ecs_fargate/README.md).
+Swap OpenSandbox for ECS Fargate by adding the ECS provider config to your
+`+config_paths` — the agent config (`configs/mini_swe_agent_2.yaml`), agent loop,
+and SWE-bench verifier are unchanged. For provider setup (AWS infra/SSM,
+credentials, the `:52222` network requirement, and automatic image mirroring via
+`auto_mirror`) see the ECS Fargate provider page under `infrastructure/sandbox`.
 SWE-bench task images are pulled into the ECR mirror on first use, so no manual
 image staging is needed.
 
@@ -503,7 +503,7 @@ Each input row needs the SWE-bench instance fields shown under
 the verifier in-sandbox, so the model is never called:
 
 ```bash
-CONFIG_PATHS="responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_ecs_fargate.yaml,responses_api_models/vllm_model/configs/vllm_model.yaml"
+CONFIG_PATHS="responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_2.yaml,nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml,responses_api_models/vllm_model/configs/vllm_model.yaml"
 
 AWS_REGION=us-east-1 ng_run "+config_paths=[$CONFIG_PATHS]" \
     ++mini_swe_agent_2.responses_api_agents.mini_swe_agent_2.run_golden=true

responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_2.yaml

@@ -27,7 +27,9 @@ mini_swe_agent_2:
         resources:
           cpu: 2
           memory_mib: 8192
-          disk_gib: 20
+          # 30 GiB works on every provider: within Fargate's 21-200 GiB ephemeral range
+          # (an explicit 20 is rejected there) and fine as an ephemeral request elsewhere.
+          disk_gib: 30
         provider_options:
           platform:
             os: linux