Stop the session’s sandbox container now

Destroys the container and releases the organization’s container slot and any credit hold the turn was holding. The next sandbox turn provisions a fresh container and restores the last /workspace backup into it, so nothing that was backed up is lost. Safe to call when no container is running. Answers 204. Authorization: work_session:manage — the OWNER relation (spec §8.1), not the comment every participant holds. A session the caller cannot see answers 404; one they can see but do not own answers 403.