feat: TTL enforcement and operational hardening (SAND-WP-0009)

Add TTL parser, expires_at on create, extend_ttl and expire/reap APIs,
activity-core integration doc, repo classification, registry refresh,
HTTP parity, and 69 tests.

docs/meta-framework.md

@@ -82,7 +82,7 @@ Extends the `build-agent` self-register pattern: generic sandbox identities carr
 | `create` | Provision from profile + inputs | **Yes** |
 | `get` | Inspect sandbox status | **Yes** |
 | `list` | List sandboxes (filter by consumer optional) | **Yes** |
-| `extend_ttl` | Extend time-to-live | Stub |
+| `extend_ttl` | Extend time-to-live | **Yes** |
 | `recreate` | Destroy and reprovision from stored seed | **Yes** |
 | `destroy` | Idempotent teardown | **Yes** |
 | `snapshot` / `restore` | Checkpoint workspace | **Yes** (compose-ssh, saas-stub) |
@@ -97,6 +97,9 @@ HTTP surface (optional v0; CLI calls core library directly):
 - `POST /v1/sandboxes/{id}/snapshot` — checkpoint
 - `POST /v1/snapshots/{id}/restore` — restore
 - `GET /v1/snapshots` — list checkpoints
+- `POST /v1/sandboxes/{id}/recreate` — recreate
+- `PATCH /v1/sandboxes/{id}/ttl` — extend TTL
+- `POST /v1/sandboxes/expire` — TTL reap (query `apply=true`)
 
 ---