[Floating-Y]

Repeated /exec and /eval calls did not update last_active_at, so the master could mark a busy hot sandbox idle once the original freeze deadline passed. Refresh activity in their shared run_exec path when accepting a hot sandbox command and again when its result arrives, including non-zero exits.

The hot check and initial Store::touch share one store lock, which is released before dispatch and awaiting the result. Rejected requests do not refresh activity, and completion only updates the timestamp, so a late result cannot undo a manual freeze. The node's existing execution protection is unchanged.

Four regression tests exercise both HTTP endpoints with controlled database timestamps and explicit demotion sweeps, without sleeps. They verify continued calls stay hot beyond the freeze threshold, idle demotion resumes after the final result, rejected calls do not extend idle, and late results preserve a manual freeze. Both continuous-call tests failed on the unmodified base with Frozen instead of Hot and pass with this fix.

Validation on WSL Ubuntu:

• cargo test -p sandstorm-core --locked --test master_api --test sandbox_access: 68 + 9 passed.
• cargo test -p sandstorm-core --locked --lib master::: 30 passed, including the four new regression tests.
• cargo test -p sandstorm-core --locked --lib tier::: 6 passed.
• cargo test -p sandstorm-core --locked --lib node::wake_tests: 18 passed.
• cargo fmt --all -- --check and git diff --check: passed.

The full repository suite and real runsc end-to-end tests were not run.