test(e2e): keep lifecycle sandboxes running

[elezar]

Summary

Align lifecycle-related E2E tests with the canonical-main, retained terminal-state, and ephemeral cleanup contracts. Use explicit durable mains where tests need a running sandbox, and make tests exercise the intended create semantics instead of silently converting lifecycle flags into scratch-plus-exec behavior.

Related Issue

No issue required: focused test maintenance correcting E2E lifecycle assumptions.

The production stale-exit race exposed by the stop/start test is addressed separately by #3132.

Changes

• Start durable canonical mains before stop/start, stopped-delete, VM overlay, and provider auto-create assertions.
• Assert stop/start launches a fresh canonical main instance while preserving workspace data.
• Cover detached successful and failing main processes reaching retained Completed and Error states.
• Cover nonzero --no-keep exit propagation followed by automatic deletion.
• Make reconnect coverage prove stdin ownership transfer instead of relying on a fixed delay.
• Run GPU workloads as canonical create-time mains and verify retained phase and exit status.
• Reject --no-keep in the persistent scratch helper and remove misleading callers.
• Keep policy-advisor sandboxes alive, separate upload from execution, and poll for mechanistic output.

Testing

• mise run pre-commit passes
• cargo test --manifest-path e2e/rust/Cargo.toml --all-features --no-run
• Affected E2E targets pass strict Clippy
• mise run e2e:mechanistic-smoke
• Focused Docker lifecycle E2E: all new cases pass; the existing stop/start case reproduces the stale ContainerExited race fixed by fix(compute): fence stale container exits during start #3132
• GPU workload E2E not run locally because a GPU is required

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for 9330f6f. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.