compute: exec hardening — no auth-replay of mutations, wall-clock deadlines, structured errors

[samcm]

panda compute sandboxes exec had four sharp edges: a 401/403 on the proxy hop replayed the entire buffered request, re-running the guest command; the CLI had no HTTP deadline anywhere, so a hung path blocked it for up to 5 minutes; the proxy's default write timeout exactly equalled the 5-minute exec ceiling; and upstream compute errors were flattened into an opaque HTTP 500: internal server error.

Auth-refresh replay is now gated to idempotent (GET/HEAD) compute requests. Mutations invalidate the cached token and return a clear retry message instead of silently double-executing. Exec calls run under a wall-clock deadline of the guest timeout plus 60s, the proxy default write_timeout moves to 6m with a 5m30s ResponseHeaderTimeout on the reverse-proxy transport, and non-2xx JSON error bodies from the compute backend are forwarded verbatim so the CLI can render their code and request_id fields alongside a new hint for 500s.

[github-actions]

🐼 Smoke eval — c4033b8: ✅ 8/8 pass

📊 Interactive report — tokens p50 17,234 · tokens/solve 17,118.

Reference points: master@a045b91 100% · v0.38.1 100%.

question	result	tokens	tools
forky_node_coverage	✅	15,414	6
tracoor_node_coverage	✅	18,125	8
mainnet_block_arrival_p50	✅	17,727	11
list_datasources	✅	13,023	2
block_count_24h	✅	16,228	8
missed_slots_24h	✅	16,741	8
chartkit_default_arrival_distribution	✅	20,413	13
storage_upload_session_scoped	✅	19,275	13

🔭 Langfuse traces (8 runs; ⚠️ = failed)

• forky_node_coverage
• tracoor_node_coverage
• mainnet_block_arrival_p50
• list_datasources
• block_count_24h
• missed_slots_24h
• chartkit_default_arrival_distribution
• storage_upload_session_scoped

_{The report walks this branch's commits against the master baseline and the most recent release. A self-contained copy is in the run's eval-smoke-* artifact.}