feat(cloud-agent-next): enforce container billing

[pandemicsyn]

Summary

• add paid start admission and balance details to the container-usage RPC while preserving the existing start contract
• gate Cloud Agent personal and organization payers independently at both producer and meter layers
• durably block shared sandboxes on budget stop, reject queued/new/reconnecting work, gracefully drain wrappers, and force-destroy after 120 seconds
• require a new successful meter admission before blocked sandboxes can resume
• make Cloud Agent session payer organization immutable

Rollout

• all Cloud Agent producer flags default to disabled and all meter Cloud Agent payer lists default to empty
• deploy the container-usage meter with recordStartV2 before enabling any Cloud Agent payer flags
• Cloud Agent service names are intentionally not added to CONTAINER_BILLING_SERVICES in this PR

Verification

• pnpm test and pnpm typecheck in packages/container-usage
• pnpm test, pnpm typecheck, and pnpm lint in services/container-usage-meter
• pnpm test:postgres in services/container-usage-meter
• pnpm test, pnpm typecheck, pnpm lint, and pnpm test:wrapper in services/cloud-agent-next
• pnpm test, pnpm typecheck, and pnpm lint in services/session-ingest
• git diff --cached --check before commit