Add multi-user sandbox session lifecycle

[chubes4]

Gap

Sandbox runs are currently single request/response jobs. Product use needs per-user sessions and lifecycle operations.

Goal

Track sandbox sessions for users/team members, including status, artifacts, cancellation, cleanup, and history.

Acceptance direction

• Create/list/read/cancel sandbox task sessions.
• Associate runs with parent principal/user and requesting agent/session.
• Store status transitions: queued, running, completed, failed, cancelled, expired.
• Make artifacts retrievable by authorized users.
• Add cleanup/retention policy.
• Support concurrent sessions with quotas.

Notes

This enables team-facing frontend chat flows where each user gets isolated coding sandboxes.