[joecklau]

Summary

Promote the Docker Sandboxes compatibility and runner resilience fixes from #57 from develop to main. These changes restore ./start after the sbx v0.49.1 upgrade and recover from readiness host-trust lease timeouts that previously stopped long-running pools.

• Support legacy and current sandbox inventory, policy-log, and diagnostic formats, including workspace-free sandboxes, while preserving strict identity and policy checks.
• Recover readiness lease-write timeouts within the existing quarantine, cleanup, and capacity rules.
• Verify cleanup and policy outcomes through fresh structured state, and finish receipt-owned staging cleanup after deferred deletion or restart.
• Check actual apt/dpkg locks before guest readiness, with bounded waiting and preservation of unfamiliar lock holders.

This promotion includes the seven implementation commits from #57 and its merge commit. The guest lock check requires a rebuilt local template or a newly published prebuilt package containing it. Live Windows relay validation remains outstanding; the macOS verification does not certify other host platforms or foreign-architecture workloads.

Validation

This promotion reuses the validation from #57; the current develop file tree exactly matches its tested head.

• All three PR workflows passed: Core runner verification, Host trust verification, and Docker Sandboxes prebuilt images.
• Full Go suite, affected normal/race checks, wrapper checks, and Windows amd64 provider test compilation passed during implementation.
• On macOS arm64 with sbx v0.49.1, default ./start brought two cached Full-template runners online and idle; logs, trust renewal, and exact shutdown cleanup were checked.
• A fresh Act build passed artifact generation, template activation, guest helper verification, runner admission, and shutdown cleanup.
• Live package-lock checks covered natural release, bounded timeout without killing an unfamiliar holder, and readiness with an unreaped apt zombie. Independent reviews found no outstanding correctness blockers.

Checklist

• I kept credentials, private keys, tokens, and machine-specific configuration out of this pull request.
• I added or updated tests where behavior changed.
• I updated relevant documentation.
• For provider or onboarding changes, I followed the Development and Extension Principles and documented and tested every intentional exception.
• I read and followed the contributing guide and code of conduct.