feat(api): add one-shot sterile cell leases

[haasonsaas]

Summary

Add a feature-flagged, one-shot sterile-cell lease path so Sandboxwich can claim already-prepared isolation cells without weakening the existing sandbox boundary.

• persist ready-cell inventory and atomically fence claims with a monotonic generation
• bind every lease and attestation to the exact release set, runtime class, policy digest, tenant, thread, runner session, and expiry
• enforce sterile -> leased -> destroyed|quarantined; no tenant-exposed guest, namespace, overlay, or sandbox can return to inventory
• require agent-side lease attestation before tenant bootstrap and stop execution when the lease expires
• add typed worker prepare, claim, and destroy commands while preserving the current cold path when the flag is disabled

Security decisions

• kata_microvm is the VM-equivalent class; gvisor_lower_risk is separately admitted and never represented as equivalent to Kata
• the signing secret is read only from SANDBOXWICH_STERILE_CELL_SIGNING_KEY_FILE, with bounded startup reads; it is never accepted as a secret-valued environment variable or CLI argument
• claim responses containing raw attestations are excluded from idempotency persistence and replay
• ambiguous cleanup quarantines the cell, and contradictory terminal cleanup replay returns a conflict
• ready inventory remains worker-tenant-owned, preventing cross-tenant inventory poisoning or claims

Contract and rollout

The versioned Sandboxwich contract and Platform integration requirements are documented in docs/sterile-cells.md. This change does not modify Deploy or Platform and does not put Cloudflare Workers in the sterile-cell request path.

SANDBOXWICH_STERILE_CELLS_ENABLED defaults to false and must remain off initially. Enabling it requires an admitted release tuple, mounted signing-key file, ready-cell producer, and provider cleanup that destroys the tenant-exposed resource before reporting destroyed.

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• focused concurrency, stale-generation, cross-tenant, expiry, attestation non-persistence, contradictory cleanup, and destroy-not-reuse regressions
• generated OpenAPI staleness/coverage tests

The conditional PostgreSQL conformance test is included but did not execute locally because SANDBOXWICH_TEST_POSTGRES_URL was not configured.

Post-Deploy Monitoring & Validation

Keep the flag off after deploy. Before a canary, confirm the mounted secret, admitted runtime class and policy digest, producer cleanup semantics, and ready inventory. During a bounded canary, watch lease-validation failures, empty claims, expiry quarantines, ambiguous cleanup conflicts, and terminal-state counts. Abort by disabling the flag; preserve terminal/quarantined rows and never return exposed cells to inventory.

---

Built with Compound Engineering