* fix(runner): add WS keepalive to handleWebSocketTerminal

The runner's iframe-terminal WebSocket handler at
apps/runner/pkg/api/controllers/proxy.go::handleWebSocketTerminal
had no keepalive — no time.Ticker, no PingMessage writes, no
SetReadDeadline / SetWriteDeadline. Sessions died at ~60s when
the AWS Proxy LB (idle_timeout default 60s) silently RSTed the
TCP connection.

Per AWS ALB User Guide HTTP 408 troubleshooting:
> "The client did not send data before the idle timeout period
>  expired. Sending a TCP keep-alive does not prevent this timeout.
>  Send at least 1 byte of data before each idle timeout period
>  elapses."

Mirrors the pattern that PR #505 already established in
boxlite_exec_attach.go::runKeepalive: a dedicated goroutine
sends a WS PingMessage every 15s via WriteControl with a 20s
write deadline, serialized with all other WS writers through
a shared sync.Mutex (gorilla/websocket forbids concurrent writes).

* fix(runner): pong-based liveness for WS attach + branch bundle

Runner: detect dead clients within ~45s (3 × keepalive interval) via
SetPongHandler + SetReadDeadline instead of relying on WriteControl
returning success — which it does even into a kernel send buffer on a
half-open TCP, keeping the single-attach slot held for ~16 minutes.
Adds TestBoxliteExecAttach_PongTimeoutEvictsDeadClient.

Bundled supporting changes already on this branch:
- api: audit decorators on box/proxy controllers; new boxlite-ws-proxy
  service; metrics interceptor + sandbox manager/service tweaks
- dashboard: SandboxTerminalTab + SandboxVncTab updates
- infra: README + sst.config.ts; Dockerfile updates across
  api/otel-collector/proxy/snapshot-manager/ssh-gateway
- src/boxlite: box_impl.rs + rest/litebox.rs
- scripts: deploy/runner-update-binary.sh

…hedLocked

Five exec-control operations guarded only on the `closed` flag, missing
the Done channel. `Done` is the canonical "exec finished" signal — closed
by the wait-task's outermost defer, guaranteed on any goroutine exit incl.
panic — while `closed` is set later in a nested defer an abnormal exit can
skip. In that race window the op fell through and acted on a dead handle:
Signal/Resize silently no-op'd (HTTP returned 204, falsely "delivered"),
and the attach (WebSocket) ops wrote to a dead pipe / signalled a gone PID.

Add one `finishedLocked()` predicate (Done-closed || closed flag, under
handleMu) and call it from all five ops, each keeping its own per-resource
nil check (execution vs stdinW) and its own error style:
- Signal (HTTP)        -> ErrExecClosed sentinel -> 409 via classifyExecError
- ResizeTTY (HTTP)     -> ErrExecClosed sentinel -> 409
- AttachSignal (WS)    -> "execution X is closed"
- AttachResize (WS)    -> "execution X is closed"
- AttachWriteStdin (WS)-> "execution X stdin is closed"

The predicate dedups the Done+closed check (one rule, one place) so a new
exec-control op can't silently forget it. Kill is intentionally untouched
— best-effort idempotent terminate, no 409 contract.

Signal's reproducer (TestBoxliteExecSignalClosedReturns409, PR boxlite-ai#505's
"Finding 10") was already red since 2026-05-12; the other four get new
reproducers.

Two-side verified (all 5):
  pre-fix:  Signal->204, Resize->400(not-tty), 3 Attach->nil error  (5 FAIL)
  post-fix: 5 PASS; pkg/api/controllers + pkg/boxlite otherwise green
            (unrelated TestExecManagerSignalUnsupportedFallsThroughToKill is
             Bug 2, fixed on a separate branch, not regressed here)

Supersedes fix/runner-signal-done-409 (Signal-only).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…hedLocked

Five exec-control operations guarded only on the `closed` flag, missing
the Done channel. `Done` is the canonical "exec finished" signal — closed
by the wait-task's outermost defer, guaranteed on any goroutine exit incl.
panic — while `closed` is set later in a nested defer an abnormal exit can
skip. In that race window the op fell through and acted on a dead handle:
Signal/Resize silently no-op'd (HTTP returned 204, falsely "delivered"),
and the attach (WebSocket) ops wrote to a dead pipe / signalled a gone PID.

Add one `finishedLocked()` predicate (Done-closed || closed flag, under
handleMu) and call it from all five ops, each keeping its own per-resource
nil check (execution vs stdinW) and its own error style:
- Signal (HTTP)        -> ErrExecClosed sentinel -> 409 via classifyExecError
- ResizeTTY (HTTP)     -> ErrExecClosed sentinel -> 409
- AttachSignal (WS)    -> "execution X is closed"
- AttachResize (WS)    -> "execution X is closed"
- AttachWriteStdin (WS)-> "execution X stdin is closed"

The predicate dedups the Done+closed check (one rule, one place) so a new
exec-control op can't silently forget it. Kill is intentionally untouched
— best-effort idempotent terminate, no 409 contract.

Signal's reproducer (TestBoxliteExecSignalClosedReturns409, PR boxlite-ai#505's
"Finding 10") was already red since 2026-05-12; the other four get new
reproducers.

Two-side verified (all 5):
  pre-fix:  Signal->204, Resize->400(not-tty), 3 Attach->nil error  (5 FAIL)
  post-fix: 5 PASS; pkg/api/controllers + pkg/boxlite otherwise green
            (unrelated TestExecManagerSignalUnsupportedFallsThroughToKill is
             Bug 2, fixed on a separate branch, not regressed here)

Supersedes fix/runner-signal-done-409 (Signal-only).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Align Utf8StreamDecoder with how production streaming decoders are
built (utf-8 crate Incomplete, vte partial_utf8, tungstenite
StringCollector):

- hold the partial codepoint in a fixed [u8; 4] instead of a Vec and
  complete at most one codepoint from it, so resuming never builds a
  joined buffer — the decoder no longer heap-allocates for its own
  state
- take chunks by value: a clean chunk (no holdover, valid UTF-8) hands
  its allocation straight to the returned String via String::from_utf8,
  removing a copy per message on the hot path
- pair each channel sender with its decoder (DecodedStream) so the two
  can't drift apart across the attach loop's exit paths; route_output
  now traces chunk length instead of decoded payload
- pin two peer-taught edge cases: a truncated surrogate prefix is
  replaced immediately (std error_len Some; CPython defers this case),
  and E2B's production shape — 0xE2 as the last byte of an 8 KiB read
  (their PR boxlite-ai#505) — reassembles across the boundary