fix(cli): reconcile provisional container exits

[shiju-nv]

Summary

Treat a driver-reported ContainerExited without a canonical main-process result as provisional for a bounded five-second reconciliation window. This prevents sandbox create --no-keep from deleting a fast finite-command sandbox before the supervisor can publish its authoritative exit status, while preserving the concrete driver error when no supervisor result arrives.

Related Issue

No issue required: this is an obvious localized bug fix for the intermittent Release Dev Rust Docker E2E failure and completes the CLI side of the lifecycle reconciliation introduced by PR #3101.

Changes

• Recognize Error sandboxes with Ready=False, reason ContainerExited, and no exit code as provisional during sandbox create.
• Continue watching until the canonical main-process result arrives, the existing provisioning deadline expires, or a fixed five-second reconciliation deadline expires.
• Keep the first reconciliation deadline fixed so repeated status events and logs cannot extend the wait.
• Preserve immediate failure for other infrastructure errors and retain the concrete ContainerExited diagnostic when reconciliation expires.
• Add deterministic integration coverage for both a later successful canonical result with --no-keep cleanup and a missing-result deadline.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (the existing Docker lifecycle test is the CI validation target)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; no architecture or public API change)