fix(sandbox): force-reprovision a provisioning session orphaned by a crashed start

[pedrofrxncx]

Problem

A shared-sandbox session for an old branch reserves forever and never reboots (reported: "Sandbox in Ferragens Floresta org didn't load, reserving forever" — the branch was very old).

Root cause: a per-branch session row stuck in status='provisioning' is never force-reprovisioned. beginStart (apps/api/src/storage/agent-sandbox-sessions.ts) only resets a row — bump generation, clear the stale handle, force a fresh provision — when desired_state='stopped' or status IN ('missing','failed'). A provisioning row with desired_state='running' hits every else branch: it re-joins its own generation and returns the existing (stale/null) sandbox_handle, so no reboot happens. Nothing times out provisioning either — there is no sweeper — so it hangs indefinitely.

An old branch makes this likely because its session row lingers un-GC'd long enough to have been left half-provisioned by an earlier start that crashed between beginStart and completeStart/failStart (e.g. the studio pod died mid-provision, or failStart no-op'd because its generation fence was already superseded).

Fix

beginStart now also treats a provisioning row older than 5 minutes on updated_at as stale and resets it — bumping the generation to fence out any zombie in-flight writes from the dead attempt, clearing the handle, and forcing a fresh provision on the next start. Self-healing; no sweeper/cron needed. 5m is safely longer than the ~180s real provision wait and matches the k8s scheduling timeout.

Testing

Added a real-Postgres integration test (agent-sandbox-sessions.integration.test.ts) asserting:

• a recent provisioning row coalesces (is not reset) — a genuine in-flight start still wins;
• a backdated (>5m) provisioning row force-reprovisions with a new generation and a null handle;
• the old generation's completeStart is fenced out.

bun run check and bun run fmt pass. (Integration test runs in CI where the test Postgres + deps are available.)

Notes / follow-ups (not in this PR)

• Did not extend finishInterruptedSharedTransition (heals stopping/reaping only) to cover stopping/reaping/deleting wedges, nor relax the status==='ready' gate in the sandbox-events self-heal. This fix alone unblocks the reported symptom; those are defense-in-depth.
• Did not add a migration to GC long-dead sessions — separate concern.

🤖 Generated with Claude Code

---

Summary by cubic

Stops shared sandbox sessions from “reserving forever” by force-reprovisioning a provisioning session that’s stale for over 5 minutes. This self-heals crashed starts so old branches can boot again.

• Bug Fixes
  • In beginStart, treat status='provisioning' rows with updated_at < now() - 5m as stale. Bump generation, clear handle/URLs, and restart provisioning to fence zombie writes.
  • Added Postgres integration test to confirm recent provisions coalesce, stale rows reboot, and old-generation completions are ignored.

^{Written for commit 70bc3e7. Summary will update on new commits.}