v0.9.66 — Sandboxes auto-stop reliably + deterministic compute billing

Sandbox lifecycle + compute billing (headline)

• Idle sandboxes now reliably auto-stop after 15 min of no real activity on every provider, and compute billing closes deterministically the moment a box stops — fixes sandboxes that kept running (and billing) for hours/days after work finished.
• Provider-agnostic reaper (real provider state = source of truth; idleness keyed off real turns), quiesce so an open tab can't resurrect a finished box, Platinum reprovision-on-open, gateway per-session usage attribution, provider lifecycle webhooks (/v1/webhooks/sandbox/*) with the reaper as a zero-config backstop, and a billing-invariant monitor.

Also in this release

• Executor unified into one CLI/MCP/SDK (#3541, #3549); OpenCode title sync (#3544); compact session digests (#3534); preview env-sync retries (#3538, #3539); revert Bedrock (#3545); credits never render as -0 (#3415); dep bumps.

What's Changed

• feat: add Platinum as a sandbox provider (stateful warm template, provider balancing + failover, admin controls) by @kubet in #3517
• chore(web): update dependencies and improve mobile UI components by @sutharjay1 in #3506
• chore: clean dead legacy code by @markokraemer in #3301
• infra hardening + DevOps platform (Waves 1-5 + gateway) by @lillyboga in #3519
• Fix forbidden project access state by @agent-kortix in #3520
• platform: all-green (ServerSideDiff, app-of-apps, runAsUser fix) by @lillyboga in #3528
• polish: align project access request state with brand by @agent-kortix in #3529
• fix(triggers): kill 500 on bad project id + make the cron scheduler reliable & diagnosable by @markokraemer in #3530
• feat(triggers): server-side per-project trigger pause toggle by @markokraemer in #3532
• fix(web): skip marketing shader without WebGL by @agent-kortix in #3531
• docs(release): defer the pre-Promote QA gate to a later pass by @markokraemer in #3535
• fix(i18n): require explicit profile language by @markokraemer in #3536
• fix(projects): return 404 for missing file content paths by @agent-kortix in #3537
• fix(preview): retry transient env sync failures by @agent-kortix in #3538
• feat(cli): add compact session digests by @agent-kortix in #3534
• fix(web): restore dev frontend SSR i18n config by @agent-kortix in #3540
• fix(sessions): sync OpenCode titles server-side by @markokraemer in #3544
• chore(deps): bump dorny/paths-filter from 3 to 4 by @dependabot[bot] in #3369
• fix(shared): never render credits as "-0" by @agent-kortix in #3415
• chore(deps): bump anchore/sbom-action from 0.17.7 to 0.24.0 by @dependabot[bot] in #3525
• chore(deps): bump sigstore/cosign-installer from 3.7.0 to 4.1.2 by @dependabot[bot] in #3526
• feat(llm-gateway): reintroduce AWS Bedrock backend under the kortix provider by @agent-kortix in #3456
• review: retry fetch-level env sync failures by @agent-kortix in #3539
• Revert Bedrock LLM gateway backend by @markokraemer in #3545
• feat: unify the Executor — one CLI/MCP/SDK, usable local + in-sandbox, published to npm by @markokraemer in #3541
• fix(sandbox): bulletproof idle auto-stop + deterministic compute billing + reimbursement by @markokraemer in #3543
• ci(executor-sdk): publish via npm Trusted Publishing (OIDC) by @markokraemer in #3549

Full Changelog: v0.9.65...v0.9.66