Add ai.harnesses.experimental and ai.workspaces.experimental

Moves harness-sdk into ai as two experimental areas: ai.harnesses.experimental drives Claude Code and Codex (run, stream, steer, stop, approve, resume, fork, TUI), and ai.workspaces.experimental says where they run (local or Vercel Sandbox).

from ai.harnesses import experimental as harnesses
from ai.workspaces import experimental as workspaces

async with harnesses.claude_code(workspace=workspaces.Local(".")) as agent:
    result = await agent.run("What does this repo do?")

• New extras claude-code and sandbox, checked at construction (InstallationError). import ai loads neither.
• Examples in examples/harnesses/, plus examples/apps/afk and examples/apps/deepysec (without its vulnerable fixture).
• Docs: basics/harnesses, basics/workspaces, and their reference pages.
• Live tests are opt-in (-m live); plain pytest stays offline.
• CI: a no-extras job, and claude-agent-sdk in the SDK compatibility job.

Proposal defaults taken: two top-level areas, ToolCall keeps its name, live tests stay out of CI.

Verified: full CI check list, the live suite against real CLIs and sandboxes, and every harness example, afk, and deepysec end to end.

Before merge: vercel/vercel-py#415 is merged and vercel-sandbox now tracks its main; once it's released, set the sandbox extra's floor and drop the git pins. Rerun pytest -m sandbox on the merged API.