Class is what the sandbox is FOR: "exec" for a code-interpreter call, "dev" for a workspace bound to a project, "desktop" for one with a screen. It decides the image, the working directory and the isolation.
Project binds the sandbox to one of the org's projects. Required for a dev or desktop class, which are single-attach per project; an exec sandbox carries none.
Runtime asks for an isolation: runc, gvisor, kata-clh or kata-fc. It is a REQUEST, not a guarantee — the sandbox that comes back carries the runtime it was actually given, which is the field to read.