feat(computers): remove Daytona from the engine; cloud dispatch targets the Lambda microVM provider contract

Founder direction 2026-09-02 (TRUTH_LEDGER): Daytona is removed product-wide; AWS Lambda microVMs are the single managed Computer substrate. This issue covers the engine side. The apps-side flip (`MANAGED_SANDBOX_PROVIDER` pin + Daytona retirement) is tracked in the `Hmbown/codewhale-apps` repo.

## Daytona surface in the engine

- `crates/tui/src/cloud_dispatch.rs` — `LiveDaytonaLauncher::create_sandbox` (HTTP `POST {DAYTONA_API}/sandbox`), fail-closed proposal/confirm flow
- `crates/tui/src/dispatch_runner.rs`, `crates/cli/src/dispatch.rs`, `crates/cli/src/cloud/tests.rs`
- `crates/secrets/src/lib.rs` — `daytona` secret slot
- `crates/tui/src/commands/groups/utility/dispatch.rs`, `jobs.rs`, `config.rs`; `crates/tui/src/computer_meter*.rs` references
- `docs/DAYTONA_CLOUD_DISPATCH.md`, `docs/GUIDE.md`, `computer/snapshots/cloud-agent/` (Daytona-shaped image — replacement tracked separately)
- `crates/tui/src/lib.rs`, `crates/cli/src/lib.rs` wiring

Note the snapshot README already records that the product dispatcher wiring for the Daytona snapshot is absent (no clone, env injection, or toolbox execution) — the engine dispatch path never reached product completeness.

## Deliver

- Extract an explicit Computer provider boundary in the engine (or ratify the alternative: engine consumes the apps control-plane provider contract over HTTP for cloud work — decide in this issue, document in `docs/`).
- Implement the Lambda microVM path under the same admission/meter rules the control plane enforces (`aws-lambda-microvm` adapter already exists in `codewhale-apps/services/control-plane/src/sandbox/`).
- Tombstone the `daytona` secret slot: readable/settleable, never usable for a new call.
- Move `docs/DAYTONA_CLOUD_DISPATCH.md` to a historical note; historic dispatch records remain readable and terminally settleable only.

## Acceptance

- No code path in the engine can create/resume a Daytona sandbox.
- `codewhale dispatch` (cloud-agent) acquires a Lambda microVM Computer end to end in a real run, with receipts.
- Clippy/fmt/tests green; docs tell one provider story.

Start with crates/tui/src/cloud_dispatch.rs, crates/tui/src/dispatch_runner.rs, crates/cli/src/dispatch.rs, and the existing aws-lambda-microvm adapter in codewhale-apps/services/control-plane/src/sandbox/. Resolve whether the engine owns a provider boundary or consumes the apps control-plane contract, then trace the listed secrets, wiring, and documentation files. Done means no new Daytona calls, Lambda microVM dispatch works end to end with receipts, historic records remain settleable, and clippy, fmt, tests, and docs are green.

Written by the indexing model from the issue text.