fix(sandboxes)!: drop the removed idle timeout and accept an unlimited session expiry

[marckong]

Change

Stop accepting the removed sandbox idle timeout and accept a session with no expiry. The API (Kong/volcano-hosting#1743) removed idle_timeout_seconds, and CreateSandboxSessionRequest rejects unknown fields. It also returns expires_at: null for a session with no lifetime limit, which local mode produces. The hand-written client still sent the removed field and raised on a null expiry. This is the companion to the OpenAPI sync PR #5, which exposes both mismatches. That branch is rebuilt by the sync bot, so the fix lands on main.

• remove the idle_timeout_seconds keyword from Sandboxes#create, so passing it raises ArgumentError instead of sending a field the API rejects
• decode SandboxSession#expires_at as Time? on create, get and refresh; a value that is neither a time nor null is still rejected, and access credentials still require an expiry
• update the public and dev type signatures to match
• document that session.expires_at is nil when a session has no lifetime limit
• generated code is untouched

Breaking: Sandboxes#create no longer accepts idle_timeout_seconds, and SandboxSession#expires_at can now be nil.

Separate from this fix: the sync PR #5 fails spec/volcano_generation_spec.rb:51 because that spec pins the SHA-256 of openapi/openapi.yaml, and a sync changes the file. Earlier contract updates (for example #344) updated the pin by hand. This PR does not touch the contract or the pin.

Verification

The new specs failed before the fix (2 of the 6) and pass after it. On this branch: bundle exec rake quality:lint, quality:types (Steep, both projects) and quality:defects pass, and the full suite (2,048 examples) passes the coverage gate at 100% lines and branches. The only failures are the four volcano_generation_spec.rb examples that need a Java runtime and the openapi-generator package, which my machine lacks; they fail identically on main here. I did not run quality:audit, quality:generated or quality:package.

Cross-language impact

Classification: wire contract. The client follows a removed request field and a nullable response field.

• Requirement IDs and affected behavior: sandbox session creation no longer accepts an idle timeout; a session's expiry may be nil.
• JavaScript / Python / Ruby companion PRs, or why each is unaffected: JavaScript fix(sandboxes)!: drop the removed idle timeout and accept an unlimited session expiry volcano-sdk-js#328 and Python fix(sandboxes)!: drop the removed idle timeout and accept an unlimited session expiry volcano-sdk-python#398 carry the same fix on the same branch name. The CLI is unaffected: its manifest already rejects idle_timeout_seconds and it models the session expiry as optional.
• Canonical scenarios, bindings and active/staged copies: none changed. Hosting's tests/sdk-contract does not use the removed option.
• Public examples updated in each affected language: docs/sandboxes.md in each repo.
• Native checks and shared acceptance evidence (with tested revisions): native checks above on this branch's head. I did not run Hosting's Staging Validation or any live scenario.

Follow the contributor workflow. Tooling checks and dry runs
are not live acceptance.

[github-actions]

AI review: no P0-P2 findings

Reviewed 8b87489. Run log

This PR removes the idle_timeout_seconds keyword from Sandboxes#create, which the API no longer accepts. SandboxSession#expires_at now decodes to Time?, so an expires_at: null reply from create, get or refresh no longer raises. Access credentials still require an expiry, and the RBS signatures and docs are updated to match. The code and tests are correct and narrowly scoped, but both changes break the public SDK contract on purpose.

Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.

• Whether the deployed API (volcano-hosting#1743) already rejects idle_timeout_seconds and returns expires_at: null.
• Whether the JavaScript and Python companion PRs (volcano-sdk-js#328, volcano-sdk-python#398) land together, so the three SDKs stay consistent.
• Whether Hosting's tests/sdk-contract scenarios avoid idle_timeout_seconds and accept a missing session expiry, as the description claims.

Human review: needed

• Is it OK that Sandboxes#create now raises ArgumentError for callers passing idle_timeout_seconds (lib/volcano/sandboxes.rb), a breaking SDK change?
• Is it OK that SandboxSession#expires_at can now be nil (sig/sandboxes.rbs)? Callers treating it as a Time will hit NoMethodError on local-mode sessions.
• Should the SDK remove Sandboxes#create's idle_timeout_seconds keyword (lib/volcano/sandboxes.rb) and make SandboxSession#expires_at nullable (sig/sandboxes.rbs), requiring callers to adapt?

The AI review found no P0-P2 problems at 8b87489, so the code needs no second review for bugs. Decide the points above: approve to accept them, or request changes.

Suggested reviewer: shawnwu-kong (recently changed lib/volcano/sandboxes.rb, sandbox_response.rb and the sandbox signatures). Any collaborator with write access other than the author can approve.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}