feat(cloud): sign agents out before sandbox delete, scrub env-build images, recipe env warning (A9, P-4)

- Worker: run orca-agent-signout (each agent's logout, then credential files) on a running sandbox
  before the provider delete; bounded (20 s) and best effort, never blocks the delete.
- Environment builds: scrub agent auth (--scrub-only) before the snapshot; fail closed.
- New VM script registered in VM_SCRIPTS + provision loop; vm-scripts regenerated.
- Main IPC ephemeralVm:forwardedEnvSummary returns names only, grouped by credential-looking.
- P-4 warning component (+ fixture) shown under Settings > recipes; delete dialog line for awake
  Orca Cloud sandboxes.

src/preload/api/ephemeral-vm-api.ts

@@ -23,6 +23,7 @@ import type {
 } from '../../shared/cloud-ssh'
 import type { CloudRemoteDesktopResult } from '../../shared/hosted-sandbox/cloud-remote-desktop'
 import type { PendingVmCheckout } from '../../shared/pending-vm-checkouts'
+import type { RecipeForwardedEnvSummary } from '../../shared/ephemeral-vm-recipe-forwarded-env'
 
 export type EphemeralVmApi = {
   listRecipes: (args: { repoId: string }) => Promise<{
@@ -45,6 +46,8 @@ export type EphemeralVmApi = {
       diagnostics: NonNullable<OrcaHooks['environmentRecipeDiagnostics']>
     }[]
   >
+  /** Names (never values) of this computer's env that recipe create scripts receive. */
+  forwardedEnvSummary: () => Promise<RecipeForwardedEnvSummary>
   doctor: (args: { repoId: string; recipeId: string }) => Promise<EphemeralVmRecipeDoctorResult>
   provision: (args: {
     repoId: string

src/preload/api/ephemeral-vm-bridge.ts

@@ -14,6 +14,7 @@ import {
 export const ephemeralVmApi = {
   listRecipes: (args) => ipcRenderer.invoke('ephemeralVm:listRecipes', args),
   listRecipeCatalog: () => ipcRenderer.invoke('ephemeralVm:listRecipeCatalog'),
+  forwardedEnvSummary: () => ipcRenderer.invoke('ephemeralVm:forwardedEnvSummary'),
   doctor: (args) => ipcRenderer.invoke('ephemeralVm:doctor', args),
   provision: (args) => ipcRenderer.invoke('ephemeralVm:provision', args),
   cancelProvision: (args) => ipcRenderer.invoke('ephemeralVm:cancelProvision', args),