[devSejung]

What Problem This Solves

Fixes an issue where sandbox package installs kept using obsolete pip settings after an operator loaded a rebuilt image with the same source tag. The transfer builder embeds an external credential-free pip.conf, so that file can change without changing the source tag; comparing only tag strings left existing sandboxes on the old image.

Why This Change Was Made

Always retire managed sandboxes after the image update passes health checks, through the existing deployment lifecycle. This removes the tag-equality shortcut and preserves the existing failure/rollback flow. Production delta is +2 lines, both explanatory comments; executable code is line-neutral. Tests are +15 lines net. No config keys or defaults are added or changed.

User Impact

Both image set and image update now make the next agent run use the loaded sandbox image even when refs are unchanged. The operator documentation explains the private build input, global pip settings, rebuilding both transfer artifacts, and workspace virtual environments. Internal repository addresses and the local pip configuration remain outside Git. Existing sandboxes are retired during an explicit image update, consistent with changed-ref updates.

Evidence

• Reproduced both same-ref set and update failures using the original deployment script: sandbox retirement was missing.
• Linux Docker focused runtime/deployment suites: 58 tests passed, including unchanged/changed refs and rollback after sandbox retirement failure.
• Latest-main Linux check passed: node scripts/platformclaw-check.mjs --changed --overlay-only --base 5109dcad941e461593b6a64b5588bcab029b66de --head HEAD, followed by the upgrade lifecycle suite (87 tests total). Lint, formatting, all 258 script declaration contracts, SDK declaration preparation, shell syntax, and root test typecheck passed. Shared upstream checks are delegated to the existing PR CI workflow.
• Independent Codex autoreview: no actionable P0-P2 findings. The patch is unchanged after rebasing onto main c77f0370ea9 (git range-diff confirms equality).
• Built the Jammy sandbox with the corrected private build input. With a read-only root filesystem, UID 0 and UID 1000 each created workspace virtual environments and installed/downloaded a synthetic wheel through an HTTP fixture using the baked configuration, without index/trust command-line overrides. Real company mirror connectivity still requires company-network verification.

The local company build input was corrected separately; that private file is intentionally absent from this PR. This PR does not publish a release or change the running company server.

CI repair

The previous head failed only the gateway-help process-exit case in the compact Node CLI shard. Rebased onto main to include the already merged one-shot native-work drain fix from #354 (aadc3dd), preserving this PR's five-file deployment diff. On the rebased Linux source, all 26 help-exit tests pass; the originally failed traced gateway-help case exits successfully in about 1.9 seconds. No timeout increases, test weakening, or duplicate CLI workaround were introduced.

Focused rebased-head Linux verification: 59 tests passed across help-exit, gateway-backed exit, one-shot process/unit, and deployment upgrade suites.