v2-platform: 12 pre-spawned sandbox pool — wildcard DNS/TLS, sleep-on-idle, workshop loop

Parent

#274 (v2 platform services spec)

What to build

The pre-spawned sandbox pool: manually deployed machines (Fly or Hetzner — decided by cost/boot profile here) from the sandbox image, behind wildcard DNS + free wildcard TLS (DNS-only CNAME + ACME-challenge delegation to the machine host), mapped to <near-id> subdomains, with sleep-on-idle so idle sandboxes cost ~nothing. No orchestrator, no spawn dashboard — just enough pool for the workshop/demo loop: a wallet-holder deploys, and their sandbox URL updates within seconds. The alchemy program gains the machines + DNS resources (buckets already exist from the storage ticket).

Acceptance criteria

• N sandbox machines run the sandbox image, each serving its account's subdomain over HTTPS
• A deploy + publish from a fresh wallet is live at the account's sandbox URL within seconds
• Idle machines sleep and wake on request without losing state
• Machine + DNS resources are declared in the alchemy program alongside the buckets
• The workshop loop (edit → deploy → refresh → see changes) is demonstrated end-to-end with a non-technical participant

Blocked by

• #285 (sandbox image)

Read parent issue #274 and blocked issue #285 first, then locate the alchemy program where the existing buckets are declared. Determine the machine provider, wildcard DNS/TLS setup, and sleep/wake flow from the specification. Done means the acceptance criteria pass, including the end-to-end workshop demonstration with a non-technical participant.