add RolloutGatewayMixin for server-side rollout execution

[rasdani]

Description

Adds RolloutGatewayMixin, a new experimental environment that offloads agent execution to sandboxes that talk directly to the vLLM rollout gateway.

The env handles sandbox lifecycle, rollout registration/unregistration, trajectory fetch, and reward — the sandboxed agent drives its own inference loop through a prime tunnel URL.

depends on PrimeIntellect-ai/prime-rl#1757
example env PrimeIntellect-ai/research-environments#162

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Test improvement

Testing

• All existing tests pass when running uv run pytest locally.
• New tests have been added to cover the changes

Checklist

• My code follows the style guidelines of this project as outlined in AGENTS.md
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Additional Notes

---

Note

Medium Risk
Adds a new rollout execution path that changes sandbox env var wiring and depends on external gateway/tunnel behavior; failures could affect agent rollouts despite being opt-in and covered by new tests.

Overview
Introduces experimental RolloutGatewayMixin that can be composed with CliAgentEnv to switch rollouts from interception-based request proxying to a server-side rollout gateway flow: it registers/unregisters rollouts with the gateway, starts a Prime Tunnel to the gateway host, launches the agent sandbox with OPENAI_BASE_URL pointing at the tunneled .../v1/rollouts/<id> endpoint, then fetches the full trajectory back into state.

Refactors CliAgentEnv interception initialization into init_interception() so gateway mode can skip creating the interception server, and adjusts cleanup/teardown to tolerate interception being absent; Environment.init_state now initializes state["completion"] to None so gateway mode can populate it later. Exposes RolloutGatewayMixin via verifiers.__init__/envs.experimental.__init__, updates environment docs to mention the mixin, and adds integration tests covering gateway/tunnel behavior and the use_gateway=False fallback path.

^{Written by Cursor Bugbot for commit 21d45c0. This will update automatically on new commits. Configure here.}

[willccbb]

Hm what's the use case here? Would prefer we don't hardcode in vLLM-specific assumptions at the env pattern level, can we make this more endpoint-agnostic?

[willccbb]

if it truly needs to be baked in to the class, would be better if it's something like a mixin and then toggled on/off via an env-level class attribute, so that eval model is still supported with other endpoints.

[mikasenghaas]

nice, this looks pretty clean!

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}