[wprazuch]

What

OpenSandboxProvider.connect now retries when reconnecting to a sandbox times out.

Why

The OpenCode sandboxed agent reconnects to its sandbox by id at the start of a rollout. Under heavy load, with about 1000 sandboxes at once, that call sometimes times out with TimeoutError: [Errno 110] Connect call failed.

• Sandbox create and commands already retry on errors like this. Reconnect did not.
• So one timeout turned into a 500 from /run, and the whole eval run stopped. We saw this on SWE-bench Pro on two clusters.

Reconnecting only reads, so trying again is safe.

How

• It reuses the existing create retry settings (create.retries, retry_delay_s, retry_max_delay_s) and the same retryable-error check.
• A missing sandbox (404) still fails at once.
• Each attempt keeps main's health check and cleanup. They moved into _connect_once.

Branch shape

The first commit sits on 1e668906, because evals pinned there need the fix on that lineage. A merge from main follows it, so the PR applies cleanly. The net change to main is provider.py plus the tests.

Tests

• New: a timeout is retried, retries stop at the limit, and a 404 is not retried. Two of them fail without the fix.
• test_connect_preserves_failure_when_cleanup_stalls now sets retries: 0, since it tests a single attempt.
• test_opensandbox_provider.py and test_opensandbox_pty.py: 200 passed.