feat(studio): support wakeable sandbox snapshots

[zakahan]

Summary

• surface expired AgentKit sandbox snapshots as wakeable Studio agents, with resume and deletion flows for Codex, OpenClaw, and Hermes
• scope sessions and snapshots to the stable signed-in user identity through AgentKit-safe UserSessionId values, while preserving administrator visibility and legacy snapshot compatibility
• provision separate temporary and recoverable Tools for each sandbox type and let users choose the session retention mode when creating an agent
• retain backward compatibility for deployments with one legacy snapshot-enabled Tool
• rate-limit shared CreateTool and UpdateTool writes to approximately three requests per second during Studio deployment

Validation

• npm test — 411 passed
• npm run build
• uv run pytest tests/cli/test_frontend_sandbox.py tests/cli/test_frontend_sandbox_options.py tests/cli/test_frontend_skill_creator.py tests/cli/test_studio_deploy_target.py tests/cli/test_studio_sandbox_tools.py tests/cli/test_studio_update.py -q — 121 passed
• uv run pre-commit run --all-files