Unconfirmed teardown should name its sandbox and be reconcilable by Runtime

[drewstone]

A settled run's teardownUnconfirmed names each node whose executor teardown was never acknowledged, but not the sandbox that node runs in. A caller that wants to confirm or finish the teardown must rebuild ownership from other records. discovery-lab#926 does that in an experiment launcher: it reads execution-admitted events from spawn-journal.jsonl, reads each named sandbox directly, and deletes the ones that still exist.

Measured on 150 collected cloud lanes (discovery-lab DIU waves, 2026-09-16 to 09-20):

• 139 tangle-sandbox nodes were in teardownUnconfirmed.
• None of their sandbox ids was in result.tree.nodes[].materialization.execution.id.
• The journal named a sandbox for 112 of them. 27 nodes, in 11 lanes, had only an intent admission, so no record holds an id to read.

Requested capability, owned here instead of in each caller:

1. UnconfirmedTeardown carries the environment id when one was admitted, and says when only an intent exists.
2. A Runtime reconcile call takes a settled run, reads each unconfirmed environment directly, deletes the ones that still exist, and returns confirmed, deleted, and unknown sets. It reads by id, so a partial provider list cannot hide a worker.

Once this exists, the launcher in discovery-lab#926 becomes a direct adapter over it.