fix: persist Daytona authentication failures

[Elioooon]

Summary

Persist Daytona 401/403 failures as a failed sandbox-provider status instead of returning an internal settings error or losing the typed error when sandbox execution converts it to a failed result.

Closes #516

Changes

• map Daytona authorization errors, including wrapped causes, to stable status_reason values
• persist the failure from snapshot refresh and runtime sandbox create/exec paths
• add focused coverage for settings refresh, sandbox creation, and existing-sandbox execution
• add patch changesets for trueforge and trueforge-core

How was this tested?

• pnpm --filter @truefoundry/trueforge-core test -- --runInBand tests/core/sandbox/daytonaSnapshotRegistration.test.ts
• pnpm --filter @truefoundry/trueforge test -- --runInBand tests/unit/sandbox/providerUtils.test.ts
• pnpm --filter @truefoundry/trueforge test:store:sqlite -- --runInBand tests/db/sqlite/sandbox-provider-store/contract.test.ts
• pnpm --filter @truefoundry/trueforge-core typecheck
• pnpm --filter @truefoundry/trueforge typecheck
• pnpm exec eslint packages/trueforge-core/src/core/sandbox/provider/DaytonaProvider.ts packages/trueforge/src/runtime/sessionResources.ts packages/trueforge/src/sandbox/providerUtils.ts
• git diff --check

Validation is intentionally scoped to the two changed packages and the Daytona failure paths; full workspace build/test and live Daytona credential revocation were not run locally. The callback is optional and database write failures are logged without replacing the original provider result. The SQLite store contract was run locally; the equivalent Postgres contract was not run because no local Postgres service was started.

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed (not applicable: no configuration or documented API change)

---

Note

Medium Risk
Changes tenant sandbox-provider persistence and concurrency on status updates; mistakes could mark providers failed incorrectly or miss updates after credential rotation.

Overview
When Daytona returns 401 or 403 (including wrapped Error.cause chains), the sandbox provider row is updated to failed with stable status_reason text instead of leaving a generic settings error or losing the signal when exec turns errors into { success: false }.

DaytonaSandboxProvider gains an optional onError hook invoked from createSandbox (before rethrow) and exec (before returning a failed result). Runtime wiring in sessionResources calls recordDaytonaAccessFailure, which writes through the store. checkSnapshotStatus uses the same path when snapshot refresh/build calls fail with auth errors.

updateSandboxStatus now accepts optional expected_manifest so status writes from an older credential/config snapshot are ignored if the tenant manifest changed concurrently; successful refresh updates pass the current manifest for the same guard.

^{Reviewed by Cursor Bugbot for commit a1379ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: a1379ae

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@truefoundry/trueforge	Patch
@truefoundry/trueforge-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0b05405. Configure here.}

[Elioooon]

Rebased onto the latest main (6848d71) and force-pushed. Revalidation after the rebase passed: Daytona provider tests (6/6), SQLite sandbox provider contract (7/7), provider utility unit test (1/1), and both @truefoundry/trueforge-core and @truefoundry/trueforge typechecks. The Postgres contract remains the documented local-environment boundary.