Recover stalled worker bootstraps promptly

[mrubens]

What changed

• propagate post-launch detached worker exits from compute providers into the controller
• bound worker claim retries to four attempts (about seven seconds of backoff)
• clean up the failed sandbox and launch one fresh replacement before terminally failing
• persist the single-restart budget as a lifecycle event so controller restarts cannot reset it
• fail runs that remain unclaimed after their environment is ready instead of waiting for the full orphan-recovery window
• add a two-minute provider-neutral bootstrap watchdog
• atomically guard the failure transition so a late exit cannot overwrite a run that already started
• clean up Modal sandboxes when a detached exit is claimed as a bootstrap failure
• process every overdue bootstrap in each watchdog scan
• commit terminal run state and the owning task projection in one transaction
• recover persisted bootstrap restarts immediately after a controller restart
• treat every grace-period detached exit, including exit code zero, as a launch failure with cleanup

Why

Detached worker processes could exit after the provider launch call had already returned successfully. The exit was visible in controller logs, but it was not connected to task lifecycle state, leaving affected runs presented as booting until orphan recovery.

Impact

Transient startup connectivity gets one fresh network path without allowing an unbounded restart loop. A replacement that also fails becomes visible promptly, and the existing long orphan-recovery timeout remains as a final safety net for broader provisioning failures.

Validation

• pnpm --filter @roomote/compute-providers check-types
• pnpm --filter @roomote/controller check-types
• pnpm --filter @roomote/types check-types
• pnpm --filter @roomote/sdk check-types
• pnpm --filter @roomote/compute-providers lint
• pnpm --filter @roomote/controller lint
• ESLint on the modified SDK client files
• focused Vitest suites for the SDK retry client, Modal adapter, Modal spawn path, base controller, provider dispatch, and sandbox timeout constants (97 tests)

[roomote-roomote]

No new code issues found. See task

• apps/controller/src/BaseController.ts:636-676 The bootstrap watchdog now processes every due run in each scan.
• apps/controller/src/BaseController.ts:720-748 The terminal transition and task-state synchronization are now committed in one transaction.
• apps/controller/src/compute-providers/spawn-modal-worker.ts:466-470 Grace-period exit code 0 is now treated as launch failure and the sandbox is cleaned up.
• apps/controller/src/BaseController.ts:679-708 Persisted bootstrap restarts are now recovered after controller state is lost.
• apps/controller/src/compute-providers/spawn-modal-worker.ts:471-564 Immediate Modal exits now use the controller's bootstrap classifier, clean up the sandbox, and schedule the one persisted replacement without falling through to the generic terminal handler.

_{Reviewed c3186df}