fix: skip live status calls for sandbox metadata lookups
GET /api/sandboxes?metadata_only=true currently ignores the flag and queries every recorded sandbox's live status. Honor the optional boolean and return the existing metadata envelope with an empty sandboxes array, skipping only live status calls. Default requests and explicit false retain existing behavior; authentication, target-account access checks, sandbox filters and repository filetree lookup remain in place.
Implements the recorded criterion in existing #215 under Mono358 on current main 88a2ae3fd17cf88e95aedff70933eef6ec733ce2. Original #215's retained head/patch does not contain the metadata-only change described in its body; this is a current-source implementation of that criterion, not a cherry-pick or legacy fallback restoration. No caller/worker migration or historical setup410 repair is claimed.
Validation: actual GET regression tests failed8/passed4 before the fix; final focused suite passes356tests across50files. All four required CI checks and response-contract typechecking pass on the refreshed exact head:7,180tests/1,286filespass (15tests/13filesskip). PreviewSUCCESS. Full lint, formatting and diff checks pass; local whole-project TypeScript has211diagnostics byte-identical to baseline. Independent Standards/Spec review has no actionable findings, at refreshed head 23ce5c1282bee3da31325c783849bb6e73268d22 (tree 0394230c79078dcfbd32a141e4633ac5a364cd74). All five candidate files are byte-identical after preserving the merged API1085 fixture update. No provider/customer/database/GitHub/billing operations, credential reads, schema/access changes or deployment settings were performed.
The change is opt-in. Public docs need the optional metadata_only true/false description through the existing maintained publication pipeline; no unrelated fixture is edited here. Source boundaries and original215 mismatch are documented in docs/verification/sandbox-metadata-only.md.