feat: migrate AKernel deployment to Python YuanRong CLI

[mhsong1998-dot]

Summary

• Migrate master, frontend, node, and standalone startup to the Python openYuanRong CLI.
• Align session log paths, persist values.log_dir_prefix, and pass the same prefix through the entrypoint/bootstrap/systemd chain. The default prefix is /home/yuanrong/sessions without an extra role segment.
• Upgrade the packaged openYuanRong release to 0.9.10, including the node core wheel URL/checksums, runtime RRT checksum, Python SDK/sandbox dependency pins, and the src/yuanrong gitlink.

Review fixes

• Render standalone node IP and embedded-etcd ports consistently.
• Keep external resource collection for node and standalone roles.
• Derive sandbox DNS from node.sandboxIPRange.
• Fail image builds if either wheel safety patch no longer matches.
• Use the complete Python 3.12 dependency constraint set.
• Wait for sandbox0 readiness before advertising the node address.
• Preserve the existing log-directory convention: master/frontend use <deploy_path>/log; node/standalone use <deploy_path>/logs.

Validation

Current HEAD: 6c9b4a0e0aee2e8424a75e145c6879d515239222, with one signed Conventional Commit and a clean worktree.

• Verified the 0.9.10 release assets and packaging references: builder/node.Dockerfile, builder/runtime.Dockerfile, sdk/python/pyproject.toml, and the core constraints file contain no stale 0.9.9 reference.
• Local Linux/amd64 validation image: akernel-ci/all-in-one:pr19-smh-python-cli-migration-0.9.10-272f15c-amd64, image manifest sha256:b517323b6b53c021dd0654909dd3be9cfb581dbaae420e561d7c75e27cfd4cea. It was built from the identical pre-squash tree before the latest TOML prefix-only update.
• In-container checks passed: openyuanrong-core==0.9.10, yr --help, yr config render --help, both wheel safety patches, and the updated log-path scripts/config.
• Config rendering passed for master, frontend, node, and standalone with the shared /home/yuanrong/sessions prefix. Master/frontend use <deploy_path>/log; node/standalone use <deploy_path>/logs; standalone etcd ports remain 2379/2380.
• The full node rebuild was also attempted; it was blocked by the external crates.io arrayref download low-speed timeout. No download URL or mirror workaround was committed.
• Earlier cn-north-4/akernel validation of the 0.9.10 image covered the main SDK examples and Traefik path. The latest AKernel change is configuration-only; the related YuanRong Python CLI behavior is tracked in GitCode PR #1002 and Buildkite Build #334.

No credentials, test/plan files, or temporary validation files are committed.

[tianyuzhou95]

One remaining process issue before merge: the current commit body contains only the Signed-off-by trailer. The repository's AGENTS.md requires a Conventional Commit with a prose body explaining what changed and why, followed by the DCO sign-off. Please amend the commit message accordingly.

Also, GitHub currently reports no checks for this branch. The validation documented in the PR is extensive, but there is no automated status attached to the commit. Please ensure the expected CI checks are configured and passing before merge, or explicitly confirm that this repository does not currently provide PR checks.

[mhsong1998-dot]

Process items are addressed in current HEAD 1e30b39: the branch contains one lowercase Conventional Commit with a prose body, and its author, committer, and Signed-off-by trailer all match mhsong1998-dot. GitHub created CI run 32334113441 for this head, but currently marks it action_required, so a maintainer must approve the fork workflow before the checks can execute. The previously approved head passed all eight CI jobs.