- Use model_copy(update=...) in test helpers so Pydantic ge=
validators are enforced during tests, not just env vars (NEW-1)
- Promote _extract_plan_id_from_sandbox to public staticmethod
and reuse in CLI active-plan detection to eliminate duplicate
plan-ID parsing logic (NEW-2)
- Cache _get_sandbox_dirs result for service instance lifetime
and have CLI active-plan detection use the cached listing so
/tmp is iterated only once per invocation (NEW-3)
- Add best-effort active plan detection from sandbox mtimes to
protect running plans from cleanup (B1)
- Add ge= validators on all retention settings to prevent unsafe
negative/zero values; checkpoint max requires ge=2 (B3, NB6)
- Handle CoW sandbox plan_id extraction (ca-cow-sandbox- prefix)
so copy-on-write sandboxes are also protected (NB4)
- Add OSError guards in sandbox dir iteration for race safety (NB7)
- Add TODO markers and CLI notice for unimplemented session cleanup (NB1)
- Rebase onto develop-hamza-1 to incorporate SEC5 changes (B2)
khyari hamza