feat(computers): remove Daytona from the engine; cloud dispatch targets the Lambda microVM provider contract

[Hmbown]

Founder direction 2026-09-02 (TRUTH_LEDGER): Daytona is removed product-wide; AWS Lambda microVMs are the single managed Computer substrate. This issue covers the engine side. The apps-side flip (MANAGED_SANDBOX_PROVIDER pin + Daytona retirement) is tracked in the Hmbown/codewhale-apps repo.

Daytona surface in the engine

• crates/tui/src/cloud_dispatch.rs — LiveDaytonaLauncher::create_sandbox (HTTP POST {DAYTONA_API}/sandbox), fail-closed proposal/confirm flow
• crates/tui/src/dispatch_runner.rs, crates/cli/src/dispatch.rs, crates/cli/src/cloud/tests.rs
• crates/secrets/src/lib.rs — daytona secret slot
• crates/tui/src/commands/groups/utility/dispatch.rs, jobs.rs, config.rs; crates/tui/src/computer_meter*.rs references
• docs/DAYTONA_CLOUD_DISPATCH.md, docs/GUIDE.md, computer/snapshots/cloud-agent/ (Daytona-shaped image — replacement tracked separately)
• crates/tui/src/lib.rs, crates/cli/src/lib.rs wiring

Note the snapshot README already records that the product dispatcher wiring for the Daytona snapshot is absent (no clone, env injection, or toolbox execution) — the engine dispatch path never reached product completeness.

Deliver

• Extract an explicit Computer provider boundary in the engine (or ratify the alternative: engine consumes the apps control-plane provider contract over HTTP for cloud work — decide in this issue, document in docs/).
• Implement the Lambda microVM path under the same admission/meter rules the control plane enforces (aws-lambda-microvm adapter already exists in codewhale-apps/services/control-plane/src/sandbox/).
• Tombstone the daytona secret slot: readable/settleable, never usable for a new call.
• Move docs/DAYTONA_CLOUD_DISPATCH.md to a historical note; historic dispatch records remain readable and terminally settleable only.

Acceptance

• No code path in the engine can create/resume a Daytona sandbox.
• codewhale dispatch (cloud-agent) acquires a Lambda microVM Computer end to end in a real run, with receipts.
• Clippy/fmt/tests green; docs tell one provider story.