Stage CSV uploads for sandbox execution

[blakestenstrom18]

What changed

• accepts CSV in the agent chat UI and Node/Python attachment validators
• parses CSV deterministically into location-aware grounding blocks
• retrieves the original uploaded bytes and stages them under input/attachments/
• makes those staged attachments available to run_code without requiring a prior generated-artifact reference
• adds focused parser and sandbox-staging tests

Why

The agent factory already registered run_code, install_packages, and read_sandbox_file, but the published app rejected native CSV MIME at the upload boundary and did not put raw uploaded files in the coding sandbox. A model could therefore appear unable to aggregate a CSV even though the failure was in the harness.

Verified behavior

An end-to-end local smoke uploaded a three-row CSV, bound the real sandbox tools at the provider boundary, called run_code, staged input/attachments/column-sum.csv, and completed with exit code 0. The tool and final answer returned 65; an independent stdlib CSV verifier also returned 65 and all five proof checks passed.

Checks

• git diff --check
• Python compileall for all changed backend modules
• deterministic CSV parser unit test passed in the application container
• async uploaded-attachment staging test passed when run directly in the application container (the image lacks the pytest async plugin)
• end-to-end Docker sandbox execution passed against pipeshubai/pipeshub-sandbox:latest

Frontend dependencies are not installed in this worktree, so a local TypeScript build was not run.

[blakestenstrom18]

I tried to retarget this source PR from main to dev as requested, but GitHub returned HTTP 422 because IterateAI/pipeshub-ai currently has no dev branch. I verified the remote branch list. Please confirm whether you want a new dev branch created from main, or whether this PR should target a different existing integration branch; I have left the base unchanged rather than creating shared branch policy implicitly.