fix(sandbox): make the SIGTERM git-sync survive to completion

[pedrofrxncx]

Summary

On SIGTERM (rollout, spot reclaim, idle eviction) the sandbox daemon commits + pushes the working tree to git. That pushed branch is the only durable copy of the user's work — the pod's /app is ephemeral emptyDir. Three ways the sync could silently drop hours of work:

1. Unmount ran before publish. shutdown() awaited mountManager.stop() first, so a hanging rclone unmount could eat the push's slice of the grace period. → Publish first; unmount moved after (best-effort, already backstopped by the sync exit handler + next-boot reclaim).
2. Push didn't skip hooks. The commit already runs --no-verify, but the push didn't — a repo's native pre-push hook could fail or hang it. → --no-verify on the push too.
3. No terminationGracePeriodSeconds. The pod used the K8s default (30s), too tight to clear commit + the 30s-bounded push (git-sync.ts DEFAULT_GIT_TIMEOUT_MS) + unmount → SIGKILL mid-sync. → Set to 90s (chart value + template), comfortably inside AWS spot's 120s reclaim notice.

Testing

• New e2e: POST /git/publish pushes past a failing pre-push hook — installs a pre-push that exit 1s and asserts the push still lands. Verified discriminating: fails (500) without --no-verify, passes with it.
• Full daemon.git.e2e.test.ts green (17/17), including the existing SIGTERM triggers a graceful publish test after the reorder.
• helm template renders terminationGracePeriodSeconds: 90 on the SandboxTemplate.
• tsc clean, bun run lint 0 errors, formatted.

Notes / follow-up

This hardens the graceful path. It does not cover a hard kill with no SIGTERM (OOM, node loss, non-graceful spot) — that still loses since the last push. A periodic/debounced background push during the session would close that gap; out of scope here.

🤖 Generated with Claude Code

---

Summary by cubic

Ensures the sandbox completes its SIGTERM git sync so user work is pushed before the pod is killed. We publish before unmount, skip pre-push hooks, and extend the pod’s shutdown window to 90s.

• Bug Fixes
  • Run publish before unmount on shutdown; unmount is best-effort to avoid blocking the push.
  • Use git push --no-verify to bypass repo pre-push hooks that could fail or hang.
  • Set terminationGracePeriodSeconds: 90 in Helm to cover commit + 30s-bounded push within AWS spot’s 120s notice.
  • Add e2e test that confirms publish succeeds past a failing pre-push hook; existing SIGTERM publish test remains green.

^{Written for commit e39e6c2. Summary will update on new commits.}