fix(api-rs): reap orphaned sandboxes and backstop lost idle pauses

[fredo]

Problem

Sandbox desired state lives in process memory (InMemoryDesiredStateStore) and idle pauses are per-execution tokio::spawn(sleep(...)) timers. A control-plane restart (deploy, crash, OOM-kill) therefore permanently orphans every live sandbox: the pods keep running, nothing references them, and no code path will ever stop them. list_observed() exists on the backend trait but is only reachable through the manual drain admin route.

We hit the end state of this in production-like use on a single-node cluster: dozens of unreferenced 512Mi sandbox pods accumulated until memory requests reached ~99% of allocatable, after which every new agent_turn failed with sandbox readiness timed out after 60s. The same failure class is reported in #172 (thread sandboxes never garbage-collect — which proposes exactly the periodic reconciler implemented here) and #171 (warm pods orphaned across restarts). #349 fixes the warm-pool slice of this on the legacy Python side; this PR covers all session sandboxes on the api-rs side.

Fix

Add a periodic sandbox janitor to centaur-session-runtime, spawned from main.rs beside the existing background tasks. Two independent arms per tick:

• Orphan sweep — diff backend.list_observed() against the durable references in Postgres (sessions.sandbox_id ∪ ready/claimed rows in session_warm_sandboxes); stop() anything running/suspended that nothing references. Safety: a sandbox must be unreferenced on two consecutive passes before it is stopped (in-flight creations get a full interval to register), Created-status sandboxes are never touched (creation can legitimately outlast an interval while pulling images), and failed stops stay pending and retry next pass.
• Idle backstop — pause sessions whose latest execution is terminal, older than a TTL, with no active execution, via the existing record_idle_pause (which re-validates the latest execution and sandbox status, so racing a live turn is safe). This restores idle-pausing for sessions whose in-process timer died with a restart — the sandbox-pod analogue of what feat: adopt orphaned executions and unwedge render recovery #486 did for executions.

Configuration (both env-tunable, additive, no behavior change when disabled):

• --session-sandbox-janitor-interval-secs (default 300, 0 disables the janitor)
• --session-sandbox-janitor-idle-backstop-secs (default 21600, 0 disables the idle arm)

No schema migration; the two new store queries are read-only.

Verification

• cargo fmt; cargo clippy --all-targets -- -D warnings clean on the three touched crates
• cargo test -p centaur-session-runtime -p centaur-session-sqlx -p centaur-sandbox-manager green, including 7 new unit tests on the pure reap-selection logic (pending→reap progression, referenced rescue, terminal/Created skip, vanished-pending cleanup)
• Known gap, stated openly: the two SQL queries have no DB-backed test — the crate currently has no Postgres test harness; happy to add one if you have a preferred shape.

A Python-side equivalent of this fix (reconciler pod sweep + retry-on-failed-teardown in agent.py) has been running on our deployment since the incident; we can contribute that too if the legacy path's lifetime warrants it.

Refs #172, #171. Complements #349.