fix: enforce sandbox execution boundary

tests/test_gateway.py

@@ -26,6 +26,7 @@ class _FakeRein(Rein):
         assert str(profile.ref) == PROFILE
         assert sandbox.sandbox_id == "sbx1"
         assert sandbox.reachability.get("workspace_dir") == "/tmp/ws"
+        assert "target_repo" not in inputs
         return {"session": "s1"}
 
     def dispatch_tool(self, session, tool_call: ToolCall) -> ToolResult:
@@ -50,6 +51,9 @@ class _FakeRein(Rein):
             resolved_model="claude-sonnet-4-6",
         )
 
+    def cleanup_session(self, session):
+        self.calls.append("cleanup_session")
+
 
 def _fake_status(sandbox_id: str = "sbx1") -> SandboxStatus:
     now = datetime.now(UTC)
@@ -86,7 +90,12 @@ def test_run_execution_creates_and_destroys_sandbox() -> None:
 
     result = run_execution(_request(), rein=rein, manager=manager)
 
-    assert rein.calls == ["start_session", "dispatch_tool", "end_session"]
+    assert rein.calls == [
+        "start_session",
+        "dispatch_tool",
+        "end_session",
+        "cleanup_session",
+    ]
     manager.create.assert_called_once()
     manager.destroy.assert_called_once_with("sbx1")
     assert result.ok is True
@@ -106,13 +115,15 @@ def test_run_execution_normalizes_execution_failure_and_tears_down() -> None:
         def dispatch_tool(self, session, tool_call):
             raise RuntimeError("boom")
 
-    result = run_execution(_request(), rein=_FailingRein(), manager=manager)
+    rein = _FailingRein()
+    result = run_execution(_request(), rein=rein, manager=manager)
 
     assert result.ok is False
     assert result.evidence.outcome == "failed"
     assert result.evidence.failure_stage == "execution"
     assert result.evidence.error == "execution failed; inspect direct caller error"
     assert result.tool_error == "boom"
+    assert rein.calls == ["start_session", "cleanup_session"]
     manager.destroy.assert_called_once_with("sbx1")