chore(sandbox): promote snapshot 3336016022d8

[iamjr15]

Context

The V2 sandbox container changed in the architecture cleanup, so production must move to a snapshot built from the reviewed main commit 3336016022d8955fbb8b2a35ad674970cdf6fef8. The first Daytona publish reached the registry but hit Daytona's exact server-side 30-second processing timeout. A clean retry completed all image scans and runtime smoke checks and produced an active candidate.

Changes

• promote cheatcode-sandbox-viewer-bundle-3336016022d8
• bind future snapshot acceptance to a run-scoped name, post-attempt timestamp, exact registry digest, region, resources, and UUID
• retry only Daytona's exact unused timeout-failed candidate, with bounded polling and identity revalidation immediately before ID-based deletion
• fail closed on malformed CLI data, duplicate names, schema drift, provenance mismatch, active/used candidates, or any other provider error
• align operator documentation with the guarded retry and authoritative Wrangler default

Verification

• snapshot workflow run 29413027822: build, Trivy configuration/vulnerability/secret scans, runtime smoke test, publish, and active-state verification passed
• active candidate ID: 253c2a52-02ac-40ca-8703-6303543b26cb (2 CPU / 4 GiB / 10 GiB, region us)
• Daytona CLI v0.197.0 is the current checksum-pinned release
• YAML parse and extracted Bash syntax validation passed
• live-object provenance predicates and negative fail-closed cases passed
• pnpm lint
• pnpm typecheck
• pnpm architecture:check
• SUPABASE_MIGRATION_URL='' pnpm deadcode
• pnpm build

Rollback

The previous production snapshot cheatcode-sandbox-viewer-bundle-20260714-1220z remains active and unchanged. Reverting the single Wrangler variable restores it; this PR does not delete either active snapshot.