chore(api): clamp sandbox duration

[jakubno]

Prevents accidentally report duration than actual sandbox duration. Prerequisite for #3199

[cursor]

PR Summary

Low Risk
Analytics and billing-adjacent metrics only; no change to sandbox lifecycle or removal behavior beyond what is emitted on close.

Overview
When a sandbox is removed, closed_instance PostHog events and InstanceStopped analytics no longer always use “now” minus start time. A new sbxStopTime helper picks an effective stop: a valid EndTime between start and now (e.g. stale records evicted late), StartTime if now is before start, otherwise now. Duration and the collector timestamp both use that value so reported runtime stays bounded and never goes negative on corrupt EndTime. Unit tests cover future/past/zero/invalid end times.

^{Reviewed by Cursor Bugbot for commit 4727aca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

If the system clock experiences drift, now can be before sbx.StartTime, resulting in a negative duration. To prevent this, ensure the returned stop time is never before sbx.StartTime by falling back to sbx.StartTime when now is before it.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
packages/api/internal/orchestrator/analytics.go	80.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!