feat(agents): scaffold buzz-sandbox-reaper with config and lifecycle planning

[tee8z]

Broken and orphaned Agent Sandboxes have no component that ends them. This PR adds the buzz-sandbox-reaper crate with its configuration contract and a pure lifecycle planner. The planner turns one classified Sandbox State and its checkpoint Evidence into at most one Action. No Action sets operatingMode: Running or creates a Sandbox. Only an expired tombstone produces Action::Delete.

• src/config.rs parses the JSON file from ConfigMap sandbox-reaper-config (key config.json). It refuses unknown fields and names the field that fails validation.
• The config is the only source of namespaces, owner pubkeys, checkpoint_bucket, checkpoint_region, and each checkpoint_prefix.

State (from buzz-backend-kubernetes::lifecycle)	Action
Ignored(why)	Ignore(why)
Binding { abandoned: true }	Tombstone, reason bind-abandoned
BindingIncomplete { expired: true }	Tombstone, reason binding-failed
Ending { reason }	Tombstone with the recorded reason
Replaced	Tombstone, reason replaced
Lost { confirmed: true }	Tombstone, reason lost
Completed, evidence Missing or Inherited	Hold until finish time + 24 h, then Tombstone, reason completed
Completed, other evidence	Tombstone, reason completed
Ended { expired: true }	Delete
All other states	None

The tombstone checkpoint value is the key for Verified and Inherited, unconfigured for Unconfigured, and missing for Missing. Unavailable evidence turns any Tombstone into None, so a later pass decides.

Stack

Position 14 of 20 in the DEV-2884 Buzz stack. Base: #3. Next: #19.

Validation

Run in a worktree at this commit (CARGO_TARGET_DIR shared, CARGO_BUILD_JOBS=4):

• cargo fmt --check: pass.
• cargo clippy -p buzz-sandbox-reaper --all-targets --locked -- -D warnings: pass.
• cargo test -p buzz-sandbox-reaper --locked: 8 passed, 0 failed. This includes the property test no_plan_resurrects_or_deletes_a_live_session.

Limits

• Temporary glue: src/main.rs declares only config and plan, has #![allow(dead_code)], and an empty fn main() {}. Layer 5 (reconcile subcommand) replaces it.
• Nothing calls the planner outside its tests yet. No cluster or S3 (Amazon Simple Storage Service) behavior is exercised.
• Buzz AGENTS.md requires a human to test the change before it leaves draft.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}