Drain deployments saved before sandbox specifications

[SaladDay]

Drain sandbox deployments that were saved before deployment specifications existed (#95), so they can be upgraded through the supported path.

Problem

Migration 000069 leaves a Web-selected Docker or microsandbox deployment with specification = '{}' and its nodes with an empty digest and generation 0. Current Core then:

• cannot load the provider, so it can't observe or clean up the retained sandboxes;
• rejects the retained nodes' authentication.

The existing PUT replacement requires zero retained resources, and the old release has no administrator archive. As a result, such a deployment can neither be drained nor upgraded.

Change

• An unspecified node-backed, Web-managed deployment loads for draining only.
• Retained nodes that never recorded a specification digest or generation reconnect. Nodes with a recorded digest or generation don't get this path.
• These are refused in this state (fail closed): fresh hosted sandboxes (same error as maintenance), enrollment tokens, node configuration reads and enrollment.
• The ordinary maintenance → administrative archive → PUT sequence then records a specification and retires those nodes.
• E2B deployments from that period are out of scope.
• Operator notes are in docs/getting-started/operations.md; the contract is in contracts/agents-api/sandbox-deployment.md.

Validation

• Directed store test TestUnspecifiedNodeDeploymentDrainsBeforeReplacement. It fails without the fix and passes with it.
• Full make check (server mode) passed on 0654e977, including the PostgreSQL suite, 610 client tests and 329 Web unit tests. Playwright browser cases were skipped on the server (Chrome unavailable; user-approved skip). No Web code changed.
• Independent blind review by a fresh Claude subagent: no P0–P2 findings. Three P3s were applied in 0654e977 and verified by focused tests and the gate, not by a second review:
  • refuse enrollment tokens in the unspecified state;
  • restrict the rule to Web-managed deployments;
  • doc wording.
• Two P3s were recorded as nonblocking:
  • pending-placement retry log noise while maintenance is off;
  • the configuration read checks the specification before the credential. This is pre-existing.
• An isolated a7ebbe7 replica (mx1/mx2, real Docker nodes, real Kimi sessions) is prepared and backed up for the end-to-end drain rehearsal. The live demo cluster is untouched.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}