test(sandboxes): aggressive integration suite + fix TTL clamping direction

scripts/test-sandboxes.py — 33-test integration suite hitting a live server:
  - wire shape (validation, 404, 400, list, snapshot, ttl clamping)
  - multi-turn warmth (turn 2/3 measurably faster than cold turn 1)
  - context retention across turns (proves engine memory works)
  - 409 BUSY on concurrent chat, then recovery after first turn ends
  - DELETE mid-chat returns in <2s without deadlock
  - 3 concurrent sandboxes each retain their own private context
  - idle TTL reaps when no chat for the configured window
  - hard TTL fires even when idle would have kept it alive
  - boot_deadline + max_concurrent_429 documented as manual checks
  Result against api.clawagent.sh: 33/33 passed.

Fix in resolveSandboxTtl: previously when idle > hard, the code clamped
hard UP to idle (so idle=300s + hard=15s became hard=300s, which made
the hard-TTL test fail and was generally confusing). The correct
semantics, matching the user's intent of "dispose after X idle OR Y total,
whichever fires first": hard cap is the authority, idle clamps DOWN to it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: kapaleshreyas

examples/computeragent-server.ts

@@ -459,9 +459,12 @@ function resolveSandboxTtl(
   if (idleRaw <= 0 || hardRaw <= 0) {
     throw new Error("idleTtlMs and ttlMs must be positive milliseconds");
   }
-  const idleTtlMs = Math.min(idleRaw, idleMax);
-  // Hard cap can never be SHORTER than idle (would make idle moot).
-  const ttlMs = Math.min(Math.max(hardRaw, idleTtlMs), hardMax);
+  // Hard cap is the authority. Idle gets clamped DOWN to it — a sandbox
+  // can't be idle-alive longer than its absolute lifetime. This matches
+  // the intuitive reading: "dispose after X idle OR after Y total,
+  // whichever fires first."
+  const ttlMs = Math.min(hardRaw, hardMax);
+  const idleTtlMs = Math.min(idleRaw, idleMax, ttlMs);
   return { idleTtlMs, ttlMs };
 }