fix(sandbox): keep Claude Code dispatches out of tenant warm pools

[pedrofrxncx]

Two bugs found while running the Electrolux pool in prod (follow-up to #5830).

1. Dispatches were eating — and de-warming — the tenant pool

The Claude Code dispatch path already asks for cloneOnly: true
(harnesses/sandbox-dispatch-client.ts): it wants a checkout, no install, no
dev server. But that claim could still resolve a tenant pool, and binding one is
worse than wasteful:

1. the claim takes a pod that cost minutes of clone + install to warm;
2. Studio then posts cloneOnly: true + the thread branch;
3. the daemon classifies branch-change → clone step → stopDevTask().

So every dispatch consumed a warm slot and killed the dev server on the pod
it took. On a size: 2 pool a couple of dispatches empty it out.

resolveTenantPool now refuses cloneOnly claims, which fall back to
warmpool: "default" — the generic pool of empty pods, which is exactly what a
dispatch wants and gets there fastest. The rule lives in the pure resolver so
it's covered by a unit test rather than implied by the call site.

2. The daemon would spawn a second dev server

POST /_sandbox/exec/<script> spawned unconditionally, while the orchestrator's
own dev task spawns with ReplaceByLogName. So an agent running dev on a pod
that is already running it — the normal state of a warmed sandbox, and exactly
what this feature creates more of — got a second Vite/Next build on the same
pod's memory limit and OOMed the pod out from under itself.

Now a well-known starter (dev/start) with a live task returns that task
({ taskId, status, alreadyRunning: true }) instead of spawning. Idempotent, so
an agent that asks twice keeps pointing at the same server rather than
restarting it — a restart on a big repo is minutes.

Ceiling worth naming: this guards the /exec route, which is the path Studio's
tooling uses. An agent shelling out to npm run dev in a terminal still
bypasses it.

Tests

• unit: a cloneOnly claim resolves no pool; cloneOnly: false still does.
• daemon e2e (black-box, real binary): with a live dev task, POST /exec/dev
  answers alreadyRunning: true and twice in a row returns the same taskId.
  The fixture helper gained an optional scripts map so a repo can declare a
  long-running dev.
• full daemon-e2e suite green.

---

Summary by cubic

Prevented Claude Code clone-only dispatches from using tenant warm pool pods, and made dev/start execution idempotent to avoid duplicate dev servers. This keeps tenant pools warm and reduces OOMs during dispatch-heavy periods.

• Bug Fixes

  • Pool routing: resolveTenantPool now takes a claim object and rejects cloneOnly claims, falling back to warmpool: "default". runner.ts passes cloneOnly. Added unit tests.
  • Daemon exec: POST /_sandbox/exec/<starter> returns the running task (alreadyRunning: true) instead of starting a second dev server. Adds RunningByLogName in the Go task manager and an e2e test.
  • Test helpers: setupBareRepo accepts scripts to define a long-running dev.

• Refactors

  • Removed sandbox spec docs from this PR.

^{Written for commit 9a89e4f. Summary will update on new commits.}