fix(sandboxes)!: drop the removed idle timeout and accept an unlimited session expiry

[marckong]

Change

Stop sending the sandbox idle timeout and accept a session with no expiry. The API (Kong/volcano-hosting#1743) removed idle_timeout_seconds, and CreateSandboxSessionRequest rejects unknown fields. It also returns expires_at: null for a session with no lifetime limit, which local mode produces. The hand-written client still sent the removed field and raised on a null expiry. This is the companion to the OpenAPI sync PR #2, which exposes both mismatches. That branch is rebuilt by the sync bot, so the fix lands on main.

• remove idle_timeout_seconds from SandboxCreateOptions and stop sending it
• decode SandboxSession.expires_at as datetime | None on create, get and refresh; a value that is neither a timestamp nor null is still rejected, and access credentials still require an expiry
• add tests and type-checker fixtures for both
• document that session.expires_at is None when a session has no lifetime limit
• generated code is untouched

Breaking: idle_timeout_seconds is now a type error, and an untyped caller's value is ignored. SandboxSession.expires_at can now be None.

Verification

The new tests failed before the fix (2 failing tests and 4 mypy errors) and pass after it. uv run --locked poe checks passes: policy, generated, lint, format, mypy, basedpyright, tests (2,679), coverage (100%), and the package checks. I did not run poe mutation. One unrelated test, test_ruff_rejects_excessive_complexity_with_project_configuration, only passes without FORCE_COLOR in the environment.

Cross-language impact

Classification: wire contract. The client follows a removed request field and a nullable response field.

• Requirement IDs and affected behavior: sandbox session creation no longer sends an idle timeout; a session's expiry may be null.
• JavaScript / Python / Ruby companion PRs, or why each is unaffected: JavaScript fix(sandboxes)!: drop the removed idle timeout and accept an unlimited session expiry volcano-sdk-js#328 and Ruby fix(sandboxes)!: drop the removed idle timeout and accept an unlimited session expiry volcano-sdk-ruby#351 carry the same fix on the same branch name. The CLI is unaffected: its manifest already rejects idle_timeout_seconds and it models the session expiry as optional.
• Canonical scenarios, bindings and active/staged copies: none changed. Hosting's tests/sdk-contract does not use the removed option.
• Public examples updated in each affected language: docs/sandboxes.md in each repo.
• Native checks and shared acceptance evidence (with tested revisions): native checks above on this branch's head. I did not run Hosting's Staging Validation or any live scenario.

Follow the contributor workflow. Tooling checks and dry runs
are not live acceptance.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

AI review: no P0-P2 findings

Reviewed 12b82f8. Run log

The hand-written sandbox client is updated to match the API contract already in openapi/openapi.yaml. It stops sending the removed idle_timeout_seconds on session create and drops it from SandboxCreateOptions. SandboxSession.expires_at is now decoded as datetime | None on create, get and refresh/update, while access expiry stays required. The code is small and correct, and the tests and type-checker fixtures cover it. The main risk is the intentional breaking change to the public SDK types.

Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.

• Whether the deployed Hosting API (Kong/volcano-hosting#1743) now rejects idle_timeout_seconds and returns expires_at: null for local-mode sessions, as the client now assumes.
• Whether the companion JavaScript (volcano-sdk-js#328) and Ruby (volcano-sdk-ruby#351) PRs make the same contract change in the same way.
• Confirm the target Kong/volcano-hosting API implements the removed idle-timeout field and nullable session expiry described in Kong/volcano-hosting#1743.

Human review: needed

• Should idle_timeout_seconds leave the public SandboxCreateOptions (sandbox_models.py), with untyped callers' values silently dropped rather than rejected?
• Is widening the public SandboxSession.expires_at to datetime | None (sandbox_session.py) acceptable for typed callers, and does the ! marker give the right release bump?
• Are removing idle_timeout_seconds from src/volcano_sdk/sandbox_models.py and making expires_at nullable in src/volcano_sdk/sandbox_session.py acceptable breaking changes for existing SDK callers?

The AI review found no P0-P2 problems at 12b82f8, so the code needs no second review for bugs. Decide the points above: approve to accept them, or request changes.

Suggested reviewer: shawnwu-kong (wrote most of the sandbox client, its tests and docs/sandboxes.md). Any collaborator with write access other than the author can approve.