feat(checkpoints): coordinate managed headless workspace writers

[brandonrjacobs]

Checkpoint suspend currently requires an application-supplied writer gate. Add opt-in --managed-headless sessions so CLI commands and uploads coordinate with down --checkpoint-dir through a built-in gate.

The source sandbox durably closes admission before draining active commands. Linux child subreapers wait for detached descendants; a lost supervisor leaves an unconfirmed receipt and prevents checkpointing. Abort tombstones fence delayed quiesce requests. The existing READY receipt, durable manifest, and stop recovery sequence remains responsible for committing the checkpoint. Restore preserves managed mode and initializes admission in the fresh sandbox.

• Supervise bootstrap, headless run/exec, streaming uploads, and config imports. Preserve streaming I/O and the workload's file-creation permissions.
• Require a digest-pinned Linux image with Python 3.9+ and sqlite3; launch implies detach. Interactive sessions, bridges, worker backends, and ordinary snapshots are refused in this mode.
• Keep receipts outside the snapshot, cap each ledger at 4096 entries, flush only the workspace filesystem, and expose admission status. Ambiguous managed commands are not automatically replayed.
• Document the cooperative boundary: older clients, direct SDK/API mutations, and independently started writers can bypass it. Unconfirmed commands cannot be force-cleared.

Validation:

• Full offline suite: 518 tests, 509 passed and 9 skipped on macOS. Seven skips are Linux-only gate tests; two are existing optional checks.
• All 14 gate tests passed in Linux Docker, including concurrent streaming, detached grandchildren, lost supervisors, PID reuse, release during drain, replay protection, capacity, and file permissions.
• Live sandbox with Claude Code 2.1.276: project upload, edit/test, injected manifest-write failure and abort, lost Create response recovered by a fresh CLI process, exact snapshot restore, native conversation resume, another edit/test, and mode/symlink preservation. Test sandboxes and snapshots were cleaned up.
• REUSE lint and git diff --check passed. Offline commands are documented in CONTRIBUTING.md; Linux gate tests use python -m unittest discover -s tests -p test_managed_gate.py -v.