Bootstrap

Sandbox-side: exchange the single-use claim token for the token pair luria-core's cloud_login.json expects. Mirrors /api/auth/cli-poll's approved response so the core's existing plumbing works unchanged; the user token is short-TTL (sandbox lifetime is bounded by credits anyway).

Unauthenticated by design — the claim token IS the credential. Atomic single-use: the UPDATE consumes the hash, so a replayed token finds no row. The lease remains provisioning until the registered core reports a working Python runtime.