fix(sandboxes): sync runtime billing API contract

[shawnwu-kong]

Refresh the private generated clients from the current Hosting public OpenAPI bundle and document confirmed Sandbox runtime billing. Running usage consumes account allowance and paid overage; suspended/uncertain usage and snapshots are not separately billed.

The complete contract sync also carries existing Issues, Autofix, variable-environment, and custom-domain schema changes. These remain behind the handwritten facades; no new public facade methods or package versions are introduced.

Validation: generation determinism, Ruff lint/format, mypy, basedpyright, all 2,676 unit tests, wheel build, and isolated package smoke test passed.

No package publication or live cloud acceptance was performed. Coordinated with the Sandbox MCP change in Kong/volcano-hosting.

[swkeever]

Reviewed the contract sync and handwritten transport boundaries. The snapshot matches Hosting #1891, with no public facade or package-version changes. Required CI, regeneration checks and native tests pass. No live-cloud testing was performed for this review. Land this snapshot before Hosting's automatic consumer sync.

[tkkhq]

The contract refresh leaves two pre-existing public-facade failures unresolved:

• An unlimited local session returns expires_at: null, which the refreshed generated model accepts. src/volcano_sdk/sandbox_session.py:89 still calls the non-null timestamp decoder, so creation fails after a successful server response. Update the public expiry type and session decoding paths; cover a null-expiry response through the facade.
• Supplying idle_timeout_seconds makes src/volcano_sdk/sandboxes.py:68 include it in the create body. The refreshed CreateSandboxSessionRequest forbids this removed field, so the server returns HTTP 400. Align the public option and request builder with the accepted contract.

The producer contract is Hosting #1891, api/components/common/schemas.yaml:7652 and :7667. These are facade gaps, not regressions introduced by regeneration.