Sandbox expiry and automatic cleanup

Sandboxes get a time-to-live and are reclaimed automatically once idle, so an abandoned session no longer holds a container and a working directory indefinitely. An optional absolute ceiling caps total lifetime regardless of activity.

Expiry is recorded as a distinct event from user-initiated deletion. Stored run output is never removed by cleanup.