fix(deps): mark boxlite posix-only, drop unused retrieval extra

[0xKT]

Summary

Two packaging defects, plus the CI simplification the second one unblocks.

raven[sandbox] could not be installed on Windows. boxlite publishes wheels for macOS and Linux only -- it is a microVM runtime built on KVM / Hypervisor.framework, and its PyPI classifiers say so -- but our declaration carried no platform marker, so the install failed outright:

error: Distribution `boxlite==0.9.5` can't be installed because it doesn't have
a source distribution or wheel for the current platform

The code already degrades gracefully when boxlite is absent: sandbox/interfaces.py keeps the shared types importable without it, and both call sites probe with try: import boxlite / except ImportError. So a Windows user should have gotten a Raven that reports the sandbox as unavailable, not a failed install. python-socks and matrix-nio already carry the same sys_platform != 'win32' marker; boxlite now does too.

The retrieval extra had no consumer. It declared torch and transformers, which nothing imports -- a whole-tree grep finds them only in that declaration, two comments, and a doc note, with no dynamic loading and no doc telling users to install it. It dates back to the initial commit. Keeping it cost a multi-hundred-megabyte download per environment and added a native crash surface of the kind cli/_exit.py documents. Removed via uv remove; the lockfile drops from 220 to 194 packages.

CI follows. With torch out of the extras, --all-extras now resolves to what the hand-maintained channels + tools + sandbox list covered, so the unit job goes back to it and stays correct as extras change. Every job also gains timeout-minutes.

A windows-latest cell was added to measure whether the marker fix was enough to run the suite there. It is not: the install now succeeds, but the suite hit 121 failures by 28 percent, across sixteen files, from systemic platform assumptions (assertions hardcoding forward slashes, fcntl locking, socket and subprocess differences). That is a port, not a fix, so the cell was dropped. This matches comparable projects: hermes-agent runs every job on ubuntu and substitutes a blocking static check for Windows-unsafe primitives, and openclaw's PR-blocking workflow is ubuntu-only with Windows behind workflow_dispatch. The dedicated Windows self-upgrade job still covers the install path.

The macos cell is dropped for the same reason, one level milder: it reported the same failures as ubuntu on every run while ubuntu additionally caught two Linux-specific problems it could not, and development happens on macos anyway. The unit job is now a single ubuntu cell, with the matrix block kept so another entry is one list item away.

Type

• Bug fix

Verification

uv run --all-extras pytest -q
# 4611 passed, 24 deselected -- same count as before, torch was never used

uv run python -c "import importlib.metadata as m; m.version('torch')"
# PackageNotFoundError, and boxlite still installs on this macOS host

bash .claude/scripts/preflight_ci.sh
# ALL PREFLIGHT CHECKS PASSED

• Relevant tests pass locally
• Relevant lint / type checks pass locally

Risk

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

raven[retrieval] stops being a valid extra. Nothing in the repo or the docs referenced it, and installing it only pulled torch into the environment without any code path using it, so no behaviour changes.

The Windows matrix experiment is described above and left out of the final state; both dependency fixes stand on their own.

Related Issues

Closes #225