feat(sandbox): add fail-closed retained cloud sessions

[drewstone]

What changed

• Add explicit ephemeral and retained Tangle Sandbox lifecycle policy.
• Keep agent-runtime as the sole execution layer and persist the exact six-field provider run reference.
• Support detach, fresh-process replay, exact cancellation, status, cleanup, and account observations through small provider-neutral modules.
• Reject retained mode before resource allocation until the provider offers exact lookup for an unacknowledged dispatch.
• Add the production lifecycle stress runner, soak validation, public redacted evidence, and tracked upstream failures.
• Update to agent-eval 0.145.3 while retaining agent-runtime 0.132.12, agent-interface 0.47.0, Sandbox 0.21.1, and current provider packages.

Proof

• pnpm check: 683 tests; 681 passed, 2 intentionally skipped, 0 failed; live-required self-test 26/26; CLI Bridge adversarial matrix passed.
• pnpm test:security: 140/140 passed; 0 known dependency vulnerabilities; 0 module cycles.
• pnpm test:package: isolated tarball install passed at 40x12, 80x24, 120x40, and 200x60; terminal, plain, and JSONL flows matched.
• Production ephemeral stress: 20/20 Braid turns through OpenCode and GLM 5.2 at concurrency 4; 20/20 unique environments deleted; active Sandbox count returned 4 to 4.
• Production retained canary: rejected before allocation in 4.695 seconds because exact provider lookup is absent; active and total Sandbox counts did not change.
• Public cloud artifacts: 5/5 pass credential-pattern and raw-account-key scans.
• Audit: 7/7 measured defects fixed; 0 unresolved high-risk findings.

Current platform limits

• Exact retained-run lookup is tracked in agent-runtime issue 800 and provider issue 146.
• Current Sandbox service authorization regression is tracked in agent-dev-container issue 5277.
• Permanent cloud provisioning retry is tracked in agent-runtime issue 808.

The Braid path fails closed for each limit and does not allocate or guess at a cloud resource.