feat(tracking): verify Braid client labels on both Sandbox lifecycles

[drewstone]

Observed gap

GTM's Braid 0.3.0 tracking plan needs to count outside accounts that ran their first Braid Sandbox turn.
Current Braid source sets metadata.owner=braid on retained environments in src/adapters/runtime/tangle-sandbox-retention.ts and on retained interactive environments in tangle-retained-interactive-contract.ts.
I found no equivalent Braid-owned label in the ordinary ephemeral path during source inspection.
That is an unverified coverage gap, not evidence that a live ephemeral Sandbox lacks the label.

Close with a real receipt

1. Run one installed public Braid ephemeral Sandbox turn and one retained turn against the served Sandbox API, then delete both exactly.
2. For each Sandbox ID, record the account ID, lifecycle, Braid client/version label, create/turn/delete UTC timestamps, and public GET/list cleanup result. Keep raw credentials out of artifacts.
3. If the ephemeral path lacks the label, add the smallest supported metadata propagation at the provider boundary. Keep Braid a terminal client over Runtime.
4. Make both paths countable by stable account ID without assuming that a Braid-created Sandbox means the person signed up through Braid.

This is acquisition instrumentation, not a new 0.3.0 release gate. Platform first-touch signup source, first_sandbox_at, and sidecar Router label forwarding are already tracked in ADC #7831.