fix(sandbox): close the sweep's two windows with a tombstone and a guarded open (#446)

[edgehero]

Closes #446.

Two windows could delete a retained run under an operator:

1. An unpinned sandbox <id> on a run past its window while the sweep was asking its runtime.
2. A pin landing while a large directory was already being deleted (a 200k-file clone takes about 10 s).

Sweep: a tombstone

After the fresh read matches, the directory is renamed to .reap-<pid>-<now>-<n> in the same root. The name never carries the job id, so no ENAMETOOLONG. The directory is then read once more through the tombstone, and only then deleted:

• A pin that landed between the fresh read and the rename puts it back, as manifest-changed.
• A rename failure holds the directory, as rename-failed, in the same sandbox_reaper_skipped family (OQ-007).
• Every reader of the root skips tombstones: the listing, listSandboxes, the runtime watch, the network sweep's keep set, doctor's count and retainJobDir.
• Leftover tombstones are cleared at the start of every pass. A tree that will not delete (root-owned files under a non-root worker) stays a tombstone: it is retried each pass, logged once a day, and named by doctor after 10 minutes.

Open: refuse late, pin first, check after launch

• A run past its deadline, or within SANDBOX_OPEN_GRACE_MS (5 min) of it, is refused unless --pin is given, and the refusal names the command.
• With --pin, the pin is written right after the run is resolved, before any runtime call. A failed pin now refuses; it used to only warn, and the launch then bound an auto-created empty directory.
• Once the container is listed, the manifest is read again. A run swept at launch has its container removed and returns swept-at-launch. The check is aborted as soon as the shell returns.
• The admin panel has no pin action. It stops offering b for such a run, and its refusal points at the CLI's --pin.

Deadline

retainJobDir writes retainUntil from the worker's window. An unpinned run's deadline is the earlier of retainUntil and createdAt plus the reader's current window. So:

• an opener with a longer window than the worker (the panel is the usual case) still agrees with the worker;
• lowering retention, or turning it off, still cleans runs retained earlier, as documented.

The one residual is written down in INT-SANDBOX-CONTRACT: a worker window lowered below both the opener's window and the run's retainUntil, with an unpinned open racing that sweep. The post-launch check reports it.

Also

• A job id with a leading dot (., .., .reap-...) is re-mapped, so it can never name the root's parent or a tombstone.
• One worker per retention root is stated as the supported configuration. A young tombstone named by another pid is left alone.

Specs

INT-SANDBOX-CONTRACT, REQ-RESURRECTABLE-SANDBOX, OQ-007, OQ-038; docs/sandbox.md.