fix: enforce sandbox execution boundary

docs/harness-contract.md

@@ -30,13 +30,15 @@ from the State Hub detail.
 class Rein(ABC):
     def start_session(
         self, profile: HarnessProfile, inputs: dict[str, str], sandbox: SandboxHandle
-    ) -> dict[str, str]: ...
+    ) -> dict[str, Any]: ...
 
     def dispatch_tool(
-        self, session: dict[str, str], tool_call: ToolCall
+        self, session: dict[str, Any], tool_call: ToolCall
     ) -> ToolResult: ...
 
-    def end_session(self, session: dict[str, str]) -> ExecutionSummary: ...
+    def end_session(self, session: dict[str, Any]) -> ExecutionSummary: ...
+
+    def cleanup_session(self, session: dict[str, Any]) -> None: ...
 ```
 
 ```text
@@ -44,13 +46,24 @@ Glas                                  rein                 sand-boxer
 ----                                  ----                 ----------
 resolve profile + rein descriptor
 create sandbox ------------------------------------------> create
-start_session(profile, inputs, handle) -> rein setup
-dispatch_tool(session, call)          -> inner loop
+derive workspace + transport from handle
+start_session(profile, inputs, handle) -> sandbox-local setup
+dispatch_tool(session, call)          -> inner loop across transport
 end_session(session)                  -> normalized facts
+cleanup_session(session)              -> remove ephemeral task material
 destroy sandbox -----------------------------------------> destroy
 publish compact ExecutionEvidence
 ```
 
+After sandbox creation, the caller's source checkout is no longer an execution
+path. A same-host descriptor must contain `pid` plus `workspace_dir` and every
+rein command is wrapped with `nsenter`; a remote descriptor must contain `ssh`
+plus `remote_dir` and every command crosses SSH. Incomplete, mixed, or unknown
+reachability refuses at session start. The transport also bounds the outer rein
+subprocess with the profile timeout. A host must make the selected rein command
+and its dependencies available inside that transport; host-only installation is
+not treated as sandbox availability.
+
 There is no production default rein. Direct `Rein` injection remains a narrow
 library/test seam but still requires a valid profile so profile, sandbox,
 model, tool policy, and evidence are explicit.
@@ -86,8 +99,9 @@ The gateway returns evidence for every normal refusal/failure path:
 - `teardown`.
 
 Profile resolution happens before sandbox creation. Once a sandbox exists,
-teardown is attempted on every path. `refused` means governed execution did not
-proceed; `failed` means an attempted lifecycle did not complete successfully.
+rein cleanup and sandbox teardown are attempted on every path. `refused` means
+governed execution did not proceed; `failed` means an attempted lifecycle did
+not complete successfully.
 
 ## Deliberate non-goals