fix(sandbox): post-merge review fixes for the sandbox wave

[yannickmonney]

What

These fixes come from an adversarial post-merge review of the sandbox wave (#4626–#4634), plus a full local run of main's checks. I checked each finding against the code and confirmed it before fixing. Every new test fails on the old code and passes with the fix.

• CPU gate (perf(sandbox): size capacity by CPU, pace starts under CPU pressure, fork-free device status #4626). Under CPU pressure, a start was held back by any waiter ahead. A create waiting for a slot that will not free (a full host whose sessions are busy or pinned) blocked every warm activation, although an activation needs no slot and was admitted before the gate existed. Waiters now record whether they wait for the CPU, and only those hold the CPU turn.
• Device slots (perf(sandbox): size capacity by CPU, pace starts under CPU pressure, fork-free device status #4626). A device now reports an admitting create as starting within a second, while the hub still counted it as in flight, so the slot counted twice. A device with room was then passed over for the server, where the session stays for its life. The hub now keeps in-flight creates by id (ref-counted for retries of one id) and counts only those the device has not reported yet. Memory headroom still counts them all.
• SESSION_OOM on attach (feat(sandbox): attribute OOM kills and retry out-of-memory runs after a pause #4633). Only the exec's first stream reported an OOM death. Long turns follow the exec over /attach, where a container the OOM killer took read as a lost session and was retried at once. An attach that stops short of the exec's end now runs the eviction check and reports SESSION_OOM.
• Egress label timing (fix(sandbox): recycle sessions whose egress proxy moved, cap egress connections per session #4630). The create read the proxy address at its start, and could join an older read. A deploy that recreated sandbox-egress meanwhile left a healthy session labelled with the old address, so the sweep recycled it. The create now reads afresh right before its run arguments. A caller whose budget is already spent no longer starts a read, which used to end as an unhandled rejection.
• Connection cap range (fix(sandbox): recycle sessions whose egress proxy moved, cap egress connections per session #4630). A cap above 4294967295 passed validation, iptables refused it, and the proxy started uncapped with a warning blaming the kernel. Such a value now refuses the start.
• Staged manifest (perf(sandbox): keep staged inputs across idle stops, one-shot egress nat rules #4631).
  • One odd entry discarded the whole manifest: a source id over 1024 characters (the API allows 2048), or a pre-1970 stat. The limit now matches the API, and a malformed entry is dropped alone.
  • A file dated before 1970 is hashed rather than trusted by its stat. Bun reports such times as 0 in nanoseconds, so the millisecond fields are checked too.
  • A comment now states the residual risk: a process with the session's uid can read the token from runnerd's /proc environ.
• Nat batch test (perf(sandbox): keep staged inputs across idle stops, one-shot egress nat rules #4631). The test read the host's /etc/resolv.conf, which made it fail inside a container on a Docker user network, and the DNS DNAT half was untested. The entrypoint now reads _RESOLV_CONF, and the test covers both resolvers.
• Integration scope (perf(sandbox): keep staged inputs across idle stops, one-shot egress nat rules #4631). main's integration-scope guard failed because file-ops.ts now imports staged-manifest.ts, which .github/ci-scope.yml didn't name. It's added.

Checks

• Spawner and runtime lint (type-aware) and type-checks are clean.
• The session-routes suites (CPU pressure, first-come line, memory, disk, egress, fake runnerd), devices/hub, the Docker backend, buildkit-resources, the egress firewall, the staged manifest and the egress recovery tests pass, except listWorkspaces, which fails the same way on main on macOS.
• The platform integration-scope guard passes.