Delegate claim waiting to Fleet SDK

[r33drichards]

Summary

• Delegate claim-wait to the Fleet UniFFI SDK's wait_claim; remove the action's separate raw-HTTP polling loop.
• Preserve CLI arguments, bound-sandbox stdout, nonzero failure exits, endpoint overrides, claim identity, wall-clock timeout, and runner-owned cleanup.
• Package a hash-pinned public cua-fleet wheel for Linux x86_64/aarch64.
• Add adapter unit tests and a real-native SDK HTTP contract test, including a release gate in nix flake check.

Draft / release dependency

The currently published wheel, 0.1.17, does not contain SDK-owned retries for NoAvailableSandbox yet. The adapter is implemented and tested with a local build of the updated SDK, but do not merge/promote this action for the new operator until a retry-capable SDK is published and both wheel URLs/hashes in nix/default.nix are updated.

The sdk-contract flake check intentionally fails with the old published wheel. This makes the release dependency an enforced gate instead of a documentation-only warning. There is no raw-HTTP retry fallback in the action.

Validation

• 73 unit tests pass; 3 opt-in native contract tests are skipped in the dependency-free unit run.
• All three native contract tests pass against the local retry-capable SDK build (real UniFFI library and loopback HTTP fixture, no mocks of SDK retry behavior).
• With public 0.1.17, the Bound case passes and the capacity-retry case fails as expected.
• Downloaded and verified both published Linux wheel hashes; x86_64 wheel import succeeds.
• git diff --check passes.
• Nix isn't installed in the local environment; CI covers packaging, with the release gate expected to fail until the wheel pin is updated.

SDK transport requirements

The native SDK requires direct API/token-endpoint connectivity (it does not honor proxy environment variables) and read access to the bound claim's template. These requirements are now documented; a native contract test pins the missing-template error behavior.