fix(sandbox2): let the sandbox leader own its namespace - #1004

Closes #1001.

A sandbox directory is reclaimable once the process it belongs to is gone, but
nothing recorded which process that is.

sandbox2 names each directory {name}-{timestamp}-{attempt}-{pid} from
std::process::id() — whoever created the sandbox, stamped there for
uniqueness. Creator and owner coincide only when the creating process is also
the one whose lifetime the sandbox tracks:

• Under the CLI they do. mip creates the sandbox, runs it, and exits, so
  its pid dying is a faithful signal that the directory is finished with.
• Under a daemon they do not. minimald creates sandboxes and outlives them
  all, and inside the microVM it is pid 1 — alive by definition, and still
  pid 1 after a restart.

How this surfaced

Found while building #1002. On
a booted VM every directory under the build base was stamped -1, and the
maintenance cycle declined every single time with
a task is in flight (build-1784239277-0-1). Nothing could distinguish a
running build from an abandoned one, so maintenance never ran and the
directory reap could never have removed anything either. That PR ships without
either half; this is what makes them possible.

Failed builds are the leak that matters here: op/src/specs.rs sets
keep_dir(true) for the duration of a build and clears it only on success, so
an interrupted or failed build deliberately leaves its tree behind.

The change

Ownership is recorded explicitly, in a leader.pid file beside the sandbox
contents. The leader pid is already available — child.id() immediately after
cmd.spawn(), already used for the netns attach.

The marker is written twice, which is the subtle part:

1. At directory creation, naming the creating process. The window between
   create_dir and spawn does real work (fs mappings, synth dir), and a
   concurrent mip cache clean must not mistake a half-built sandbox for an
   abandoned one. Today that window is safe only by accident, because the name's
   pid happens to be the live creator's.
2. After spawn, naming the leader — the process whose death actually means the
   directory is finished with. Rewritten per invocation, so a sandbox running
   several execs always names the current one.

The contract lives in common::sandbox_owner rather than sandbox2, so readers
that should not depend on the sandbox implementation can still answer the
question. mip cache clean switches to it, and one rule now works for the CLI
and the daemon alike.

Unknown stays distinct from unowned. A directory with no marker predates it,
or was abandoned before its leader spawned; both must be left alone. That is
what keeps this safe to land on a tree full of pre-existing sandbox directories.

Residual

If the daemon crashes during the setup window, the directory is left naming
pid 1, and after a restart pid 1 is alive again — so it is never reclaimed.
Narrow, and strictly better than today (where every directory has that property
permanently), but not zero. Closing it properly needs something a restart
invalidates, such as a boot id alongside the pid. Left out rather than guessed
at.

Also left out: the directory name keeps its -<pid> suffix, now purely for
uniqueness. Removing it is a bigger behavioural change and nothing reads it for
liveness any more.

Not included

Re-adding the maintenance reap and a build-aware deferral to
#1002. That PR is already open
with both removed; they come back on this signal once both land. Note also that
ListSessions already exposes session liveness and activity timestamps, which
is a better basis for the deferral half than a pid scan — discussed on
#1001.

Verification

• cross (aarch64 musl): common 52, sandbox2 12, mip 14 — all pass.
  Includes the two /proc-gated tests that cannot run on macOS, so the
  live-owner vs dead-owner distinction is genuinely exercised rather than just
  the parsing.
• cross clippy -p common -p sandbox2 -p mip --all-targets -- -D warnings: clean.
• just ci on macOS: green.

Not exercised: a real build writing and handing over its marker on a booted VM.
The write sites are two lines each on paths covered by the existing sandbox
tests, but the handover itself has not been observed end-to-end.

🤖 Generated with Claude Code