Sandbox layer: sync/async parity fixes and hardening

[sfroment]

Summary

The sandbox layer's sync and async twins had shipped drift, plus a hardening
batch: service pools, lazy list handles, opt-in exec errors, fail-closed
readiness, and create-failure cleanup. Examples cover every new public
surface (28–31), porting the pool/claim walkthroughs from #64 onto the
spec-based pool API.

 AsyncSandbox.create(          # main
-  idle_timeout: int = 0,        # always-on — drifted from sync's 300
-  enable_mesh: bool = False,   # mesh disabled — drifted from sync's auto
+  idle_timeout: int = 300,      # scale-to-zero, identical to sync
+  enable_mesh: Optional[bool] = None,  # mesh tri-state: auto
 )

commits (each green, vertical slice):
├── fix: fail closed on terminal deployment states
├── feat: typed errors for token, port, secret gates
├── feat: retry executor 5xx/network errors, wrap 4xx
├── feat: clean up sandbox when create fails or times out
├── feat: service pools and sandbox claims   ← supersedes #64
├── feat: Sandbox.list with lazy handles
├── feat: opt-in raise_on_error for exec
├── fix: align async create defaults + guard caller apps  ← parity pins
├── refactor: build deployment definition once per create twin
├── fix: tell the truth when cleanup fails
├── test: pin file IO twins and matrix corners
├── docs: regenerate reference docs, scope out test modules
└── docs: add examples for pools, claims, list, raise_on_error

Evidence

• Before: main silently builds different sandboxes per flavor:

  main:sandbox.py:1721  idle_timeout: int = 0      # sync: 300
  main:sandbox.py:1730  enable_mesh: bool = False  # sync: None (auto)
  

  The parity guard written first fails exactly on this:

  FAILED test_async_create_matches_sync_defaults
    AssertionError: 0 != 300 — idle_timeout default drifted from sync
  

• After: 160 passed; two fresh-context review rounds verified
  sync/async CreateService payloads identical (mesh auto, deep sleep 300)
  and that the JS mirror expects exactly these defaults (JS mirrors sync:
  DEFAULT_IDLE_TIMEOUT = 300).

Merge Danger

Door: two-way — behavior changes are deliberate and revertible; public
interfaces unchanged and pinned.

Blast Radius: SDK-wide.

Observable changes: (1) async-create defaults now match sync (scale-to-zero,
mesh auto); (2) is_healthy()/wait_ready() raise SandboxDeploymentError
on terminal states instead of polling to timeout (fail closed); (3)
cleanup_on_failure deletes only the service when the app is
caller-provided; (4) pools work supersedes #64 (this branch's version is the
newer, spec-integrated one — close #64 on merge). Release-note the
scaled-to-zero raise for 1.5.x monitors.