🏗️ build-from-issue-agent

Summary

Prevent one slow sandbox deletion from blocking unrelated watcher events or deletes. The gateway now serializes duplicate deletes per stable sandbox ID, persists and recovers deletion transitions with version checks, and performs backend calls outside the gateway-wide state guard.

Related Issue

Closes #2326

Changes

• Add weak, per-sandbox delete gates so duplicate requests share one driver call without blocking other sandbox IDs.
• Bind a delete to the ID resolved at request start, preserve the workflow after client cancellation, and never retarget a reused sandbox name.
• Make watcher reconciliation deletion-aware and ignore unknown backend snapshots while logging the dropped event.
• Recover failed driver deletes from an observed backend snapshot, remove an absent backend row, or roll back the exact deleting version when the backend state is inconclusive.
• Delete sandbox rows by stable ID and resource version while retaining the existing best-effort name-based settings cleanup.
• Extend concurrency, cancellation, name-reuse, cleanup, and recovery regression coverage; harden lifecycle E2E polling and diagnostics.
• Document the stable deletion invariants and the current gateway-restart limitation.

Deviations from Plan

Settings cleanup intentionally retains its existing best-effort name-based behavior. An earlier atomic persistence extension was removed to keep this PR scoped to the deletion concurrency issue.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (execution delegated to the labeled Branch E2E Checks workflow)

Tests added or updated:

• Compute: 25 regression tests covering lock isolation, duplicate deletes, cancellation, name reuse, watcher races, recovery, and cleanup.
• E2E: 2 sandbox lifecycle cases now use deadline-based polling with final-state diagnostics.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated