A Runtime outage no longer stops or deletes running sandboxes

A sandbox without a time limit (or before its time limit) has its lease renewed by Runtime while it runs. If Runtime cannot renew the lease, its server now pauses the sandbox at the lease's end, keeping its memory and disk, whatever onTimeout says. Once Runtime renews leases again, the sandbox wakes and runs, with what was left of its time limit; if the account can no longer pay for it or its key was revoked, it ends as onTimeout says, with the reason in stopReason. Previously a sandbox with onTimeout: "stop" or "delete" was stopped with stopReason time_limit (with "delete", its disk was deleted), and one with "pause" stayed paused until its next request. The time between the lease's end and the wake is not billed for compute, and paused storage is billed only from when Runtime recovered. Sandboxes created with pausable: false before 5 October 2026 cannot pause, and still stop.