Keep sandbox contract links aligned with the installed AI package

[rmcdaniel]

Problem

The Sample App installs an exact durable-workflow/ai build through composer.json and composer.lock, but docs/sandbox-orchestration.md links provider authors to the AI repository's moving main branch. At the current Sample App lock reference (4a9a1c77f256a68ae5b494349fc3f8b636110569), SnapshotDeletingSandboxProvider and SnapshotReconcilingSandboxProvider do not exist; the linked main guides now require and describe those newer interfaces. A first-time user following the Sample App therefore receives a contract that cannot be implemented against the package the app actually installs.

Acceptance criteria

• The delivery/recovery and provider-author links resolve documentation compatible with the AI package installed by the Sample App, without presenting a moving development branch as the contract for an older locked build.
• Any immutable ref shown or embedded in generated guidance comes from the app's package metadata or lock authority rather than a separately maintained prerelease number.
• A focused repository check fails when the linked AI contract moves out of alignment with the installed package, without asserting prose wording or Markdown layout.
• The runnable sandbox walkthrough and provider-author examples are verified against the resolved package contract.

Delete when

Delete this issue when a fresh checkout's sandbox guide leads to contract pages compatible with its resolved durable-workflow/ai package and automated validation prevents that relationship from drifting.