refactor: wave a correctness hardening

[iamjr15]

Wave A of the Codex-approved architecture-hardening plan (rev 5.3). Five commits, each gate-verified; A1 adversarially reviewed twice (verdicts: EQUIVALENT).

• A1: ProjectSandbox's 5-level inheritance chain dissolved into one DurableObject + composed operation modules over an explicit runtime handle. Commit 1 made all 9 hidden virtual-dispatch lease edges explicit with a zero-delta lease-scope proof; commit 2 restructured with method-for-method parity (policy table SHA-identical, 36/36 RPC surface, storage keys unchanged). deleteAccountState now inventoried under a no-lease control policy (lease-wrapping it would self-deadlock); the lease core is its own auditable module.
• A2 Phase 1: QuotaTracker implementation + retention extracted to worker-only @cheatcode/billing/quota-runtime (not root-exported; Node-side consumers verified unaffected) with runtime input validation on every public method and an RPC-only dependency-cruiser guard.
• A3: one writer for stream-driven workspace-surface state — pure part interpreter + shared applier; statuses are idempotent reductions, tab-open is once-per threadId:toolCallId. Live-QA'd: two consecutive runs in one thread, mid-run reload rehydration, SSE reconnect replay, zero console errors.
• A4: sandbox file/exec wire shapes single-sourced in @cheatcode/types; golden compare proves all four wire schemas byte-identical (SHA-256).

Gates per commit: biome, tsc, turbo build --force (23/23 incl. wrangler dry-runs), knip zero findings, dependency-cruiser clean.