fix(sandbox): timeout Lambda MicroVM requests - #15974

Summary

• abort Lambda MicroVM sandbox operation requests after a bounded timeout
• preserve the requested bash execution budget with a five-second transport grace period
• cap each bridge health probe to the remaining readiness deadline, including response-body reads
• add regressions for hung sandbox operations and hung health probes

Impacted packages

• @langfuse/shared
• web server unit tests

Verification

• pnpm --filter @langfuse/shared run build (passes)
• pnpm --filter @langfuse/shared run lint (passes)
• pnpm --filter worker run typecheck (passes)
• pnpm --filter web run test src/tests/server/unit/in-app-agent-lambda-microvm-provider.servertest.ts (Test Files 1 passed (1); Tests 5 passed (5))
• pnpm exec prettier --check on both changed files (passes)
• git diff upstream/main...HEAD --check (passes)

Notes

• The local machine runs Node 22 while the repo requires Node 24. Node 22 globSync returns Windows backslash paths, so the focused test used a temporary uncommitted path normalization to select the normal server-shared-source-unit project; CI runs the committed config on Node 24.
• pnpm run lint did not complete locally and was stopped after hanging without output; the focused shared lint passed.
• This change adds no new user-configurable URL or redirect behavior; the endpoint remains AWS-provided.

Closes #15956

sequenceDiagram
  participant Session as ensureSession
  participant Bridge as waitForBridge
  participant AWS as Auth-token API
  participant Health as Bridge /health
  Session->>Bridge: wait for readiness (30s target)
  Bridge->>AWS: createMicrovmAuthToken
  Note over Bridge,AWS: No remaining-deadline timeout
  AWS-->>Bridge: token after unbounded delay
  Bridge->>Bridge: calculate remainingMs
  alt Deadline remains
    Bridge->>Health: fetch with AbortSignal(remainingMs)
    Health-->>Bridge: health result
  else Deadline expired
    Bridge-->>Session: readiness failure after excess wall time
  end

### Issue 1
packages/shared/src/in-app-agent/server/sandbox/providers/lambdaMicrovm.ts:381
**Auth request escapes readiness deadline**

When the Lambda MicroVM auth-token API stalls or exceeds the remaining readiness window, `waitForBridge` awaits it before calculating `remainingMs`, causing `ensureSession` to remain blocked beyond the intended 30-second bound.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(sandbox): timeout Lambda MicroVM req..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.