refactor: prototype a unified sandbox launch identity #4786

User Story

As an OpenShell maintainer, I want a draft prototype of a simpler sandbox launch identity model so that lifecycle, credential, and driver ownership rules are easier to assess and maintain. This task records the directly requested prototype and Claude Code Opus 5.5 review.

Description

Centralize durable launch identity and its lifecycle transitions. Keep one typed value for the runtime generation and its authorization epoch, derive the protocol session identity centrally, and preserve the existing persisted and wire formats in this first prototype.

Context

A persistent sandbox can have multiple launches, including when a compute resource is reused. A launch identity must survive retries and gateway restarts, change on a later launch, and reject credentials from earlier launches. Authorization epochs also participate in Sandbox Protocol connection coordination; the current authenticator admits only the fixed launch epoch, making the registry's epoch-ordering branches redundant in production. This prototype preserves the wire format; a follow-up can remove the epoch and those branches together while retaining connection-ID and process ownership.

This is an internal refactoring prototype. It introduces no CLI or configuration changes. Existing provider, middleware, and interceptor extension points do not own launch lifecycle and cannot implement this consolidation.

Definition of Done

• Durable launch creation, advancement, matching, and session derivation use one shared model.
• Existing persistence, token, and protocol formats remain compatible.
• Tests exercise renewal/retry identity retention, new-launch fencing, and epoch exhaustion.
• Claude Code Opus 5.5 reviews the prototype; findings and validation limits are recorded in a draft PR.