[SaladDay]

Sandbox reset and the installation address bindings move out of store into deployment and deploymentpg.

What changes

• deployment:
  • ResetRequest, ResetAuto/ResetForce, and the deadline bounds MinResetDeadlineSeconds/MaxResetDeadlineSeconds.
  • InUseError, which unwraps to ErrConflict.
  • The reset rules, and the ExecutionOperations use cases StartReset, CancelReset, AdvanceResetDeadline and CompleteReset.
  • Reader.ResetSessions and Reader.AddressBindings.
  • Service.AddressBindings, so the public URL keeps its single home in the Service.
• deploymentpg:
  • DeploymentTx gains the reset start, force, cancel, complete and audit-source methods. The audit source has one decoder, ResetSource.
  • AddressBindings reads both counts in one snapshot.
• execution:
  • Every reset write runs on the lease-bound Owner.Deployment.
  • The Dispatcher.DeploymentReader field is required.
• api:
  • The reset and installation handlers use writeDeploymentError and the deployment rule constants.
  • writeSandboxError maps InUseError to 409 sandbox_in_use.
  • writeStoreError stays as the composite (reset admission → sandbox → sessions) until the error-mapper cleanup.
• Removed from store: sandbox_reset.go and sandboxResetAudit. Reset admission and the reset's Session archive stay in store until their own PRs.
• OpenAPI: schemas are renamed to deployment.ResetRequest and deployment.AddressBindings, regenerated with make openapi.

Behavior

The HTTP status, code, message and details of every reset and installation route are unchanged. Reset validation now returns deployment.ErrInvalidInput, which still maps to the same 400 invalid_request. A stored reset source that cannot be decoded is an internal error in the reset loop, including in the archive step. No HTTP caller can reach it.

Checks

• go build ./... and go vet ./services/core/....
• deployment and deploymentpg in full (PostgreSQL, no skips), including:
  • a reset race;
  • a closed lease;
  • rollback;
  • the audit actor sequence.
• execution -run 'TestStartWorker|TestWorkerRunClosesLeaseAfterDrain|Reset'.
• store -run over the reset, archive and dispatch tests.
• api -run '^TestSandbox|Installation', and cmd/server.
• make openapi produces no diff, and scripts/check-names.py passes.

A blind review found no blockers or majors. Its minor findings are fixed in this commit.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}