Command retention: task-scale TTL and expiry visibility on handles

[cf-pages]

Targeted: 0.5.0 (reliability program). Baseline: release/0.3.0.

0.2.x telemetry: read_output failed 58.2% of calls, dominated by expired handles rather than misuse. A completed command's output is retained for COMPLETED_COMMAND_TTL_SECONDS = 300 with an LRU cap of MAX_RETAINED_OUTPUT_COMMANDS = 32 (server.py:197-199), while next_action actively hands the reference to the model — which then does something else for six minutes and comes back to a dead handle.

• Raise the completed-command TTL to task-scale (1800–3600 s), re-budgeted against the 32-entry/16 MB retention pool.
• Hand out expiry with the handle: exec_command/write_stdin/read_output payloads and next_action carry retained_until (or expires_in_ms).
• 0.3.0 already added recovery hints to COMMAND_NOT_FOUND; extend details.reason to expired | evicted | never-existed via a bounded tombstone record of recently retired ids.
• Per-client quotas and cross-client cursor semantics stay in Per-client resource quotas for the shared workspace runtime #46.