fix(server): serialize sandbox restart authentication

[drew]

Summary

A stopped sandbox could rotate its runtime identity before acquiring the compute lifecycle locks, allowing reconciliation or another start to invalidate the CAS or launch with credentials that no longer matched persisted state. Commit the identity rotation and Starting transition in one resource-version update, retry conflicts, and make idempotent starts reuse the winning identity.

Related Issue

No issue required: localized concurrency bug confirmed across the reviewed lifecycle failures and requested directly for implementation.

Changes

• Move restart authentication preparation inside the sandbox lifecycle and global state guards.
• Atomically persist the new authorization identity with the Starting phase.
• Retry CAS conflicts and reuse the persisted identity when another start wins.
• Add a regression test covering the single-write transition, matching launch credentials, and idempotent retry.
• Document the cross-replica lifecycle invariant.

Testing

• mise run pre-commit passes
• mise run test passes
• Focused authenticated restart regression test passes
• Unit tests added/updated
• E2E tests added/updated (not applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

[github-actions]

Label test:e2e applied for 924f043. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[drew]

gator-agent

PR Review Status

The initial code review found no validated blocking findings. The sandbox lifecycle change requires the standard E2E suite, but applying test:e2e did not dispatch it automatically.

Action required: A maintainer must open Branch E2E run 35482747929 and choose Re-run all jobs so the suite executes with test:e2e applied.

Blocking findings:

• No blocking findings remain

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Project-valid localized concurrency fix authored by a verified repository admin
• Docs: Fern docs are not needed because this does not change a direct user-facing interface; the lifecycle architecture note was updated
• Checks: Branch Checks, Helm Lint, and Trivy Changes passed on the current head; the required-gates publisher is refreshing after the label change
• E2E: test:e2e is applied, but the existing Branch E2E run must be rerun before testing is dispatched
• Head SHA: 924f04336de15432fe6ef3496048c378f87b4b37
• Base SHA: d6f3e1f5f2fcb38d8feb5ad90574a057ae805486
• Merge base SHA: d6f3e1f5f2fcb38d8feb5ad90574a057ae805486
• Patch ID: 2fac353ec3c84e803f3b27576f4be9c920a7d2d7
• Gator payload: 9
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:blocked
• Blocked reason: test_dispatch_required

[elezar]

Reviewed the lifecycle and authentication changes. Moving restart identity preparation under lifecycle serialization and committing the identity with the Starting transition in one CAS closes the stale-credential window; idempotent retries correctly reuse the persisted winning identity. All required checks, including Core E2E, are green. Approved.

[drew]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: the current head passed the required branch, Helm, Trivy, and Core E2E checks, received maintainer approval, and reached gator:merge-ready before merge.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.