fix(sandbox): preserve stopped resume failures

[shekohex]

Summary

• propagate stopped-box lookup and resume failures unchanged by default; never delete or create on that path
• add recoverStoppedSandbox typed seam so products own snapshot/delete/confirmation policy, then authorize replacement creation
• require a fresh replacement key for both sandbox name and idempotency identity; optionally override or suppress restore

Validation

• pnpm vitest run src/sandbox/index.test.ts (120 passed)
• pnpm typecheck
• NODE_OPTIONS=--max-old-space-size=8192 pnpm build
• pnpm test (138 files, 2,244 tests passed)
• git diff --check HEAD^ HEAD

Proof

• L1 local regression: a 409 EGRESS_PROXY_RECOVERY_REQUIRED-shaped error from match.resume() reaches the caller by object identity, with zero delete/create calls.
• Recovery regression: product callback receives stopped box + error, performs its own delete, supplies snapshot restore, and creates only with box-w1-recovery as both name and idempotency key.

Consumer Path

• tangle-network/gtm-agent#562 can return ok(null) while awaiting explicit retention approval, or snapshot/delete then return a durable fresh replacementBoxKey and restore spec.

Review Guide

• src/sandbox/index.ts: Stage 2 now fails loud by default and permits only explicit product-authorized recovery.
• src/sandbox/index.test.ts: typed/generic propagation, no implicit deletion, fresh identity enforcement, and restore decisions.

Closes #183