perf(runtime): optimize managed startup and native E2B suspension

[sam2tom]

Managed Sessions can wait for periodic scans and unnecessary startup work, while direct E2B compute cannot release idle capacity through the shared suspension lifecycle. This change wakes bounded workers from committed lifecycle events, propagates the Session-selected Harness, overlaps independent startup checks, and implements native E2B pause/resume through the single SandboxProvider contract.

The shared protocol uses adapter-owned opaque RetainedState, explicit RenewCompute/DeleteRetained operations, exact generation ownership, and durable no-replay recovery. E2B preserves its native sandbox identity across logical generations; microsandbox wraps its native snapshot identity in the same envelope. Core suspends initialized idle Environments including those without a Turn, counts every unreleased allocation against retained capacity, and keeps independent workspace ownership on the allocation's original deployment generation. Direct active/retained limits are process settings and reach Core through the standard Compose installation.

The branch includes upstream main 601da24829386c03bd06b3557f3bd1afd09d33ee, preserving capacity scheduling, initialization deadlines and uncertainty handling, resident executors, checkpoint retention and cross-node restoration. The upstream baseline supplies schema 99 and Runtime wire 0.16.0. Direct native pause may omit checkpoint portability tokens; node transfers require matching artifact-domain/execution-class qualifications and settled source cleanup. Core never interprets adapter-owned Data.

Coordinated provider boundaries are node wire 8, E2B helper 4, microsandbox helper 5 and Runtime bootstrap 2. Existing Runtime instances require an explicit qualified upgrade path. The startup SQL fence rejects missing/unknown versions and known legacy shared snapshot fields; it does not interpret opaque Data or replace the strict Go decoder. Compatible retained-state v1 envelopes remain readable unchanged.

Both suspension adapters durably fence late operation IDs before reporting an unstarted suspension as settled. Their bounded per-source journals reject replay and retain unknown dispatched work. E2B cleanup distinguishes a still-paused source from resumed compute and reconciles a lost deletion response. A restore attempt can close only with exact durable proof that native restoration was never dispatched. These rules preserve ownership across crashes without cold-replay fallbacks.

Retained-state capacity queries and node statistics read the shared retained envelope. Database regressions serialize real compute state to cover wake demand, expiry, portability qualification and rejection of legacy snapshot shapes.

Validation on head a166c8223bacd9e65949b42718abf50d46f15820:

• Full PostgreSQL integration passed with 757 passing cases and 12 documented prerequisite skips. Follow-up lifecycle/race tests cover the affected recovery and cleanup changes; deterministic fixtures do not qualify live cloud behavior.
• Affected Go race, provider/bootstrap contracts, generated projections and English/Chinese documentation checks passed. E2B template 11 and helper 242 tests passed.
• Fresh independent complete-diff review found no actionable P1/P2 after validation.
• Native Linux CI, including the official microsandbox helper unit/vet script, passed in run 38105111718. The local amd64 emulation had a Go vet crash and is not reported as a successful full gate.
• Two local deploymentpg host-history sampling tests fail identically on this candidate and exact upstream 601da248; their unchanged code is not reported as passing.
• The earlier controlled two-step overlap benchmark established the concurrency mechanism, not production cloud latency.

Tracing is supplied by dependent #643. No live E2B allocation, model call, deployment or production acceptance was performed. This remains a draft for protocol/release review and live template qualification.