#1057 Sandbox shell: stderr log read 409 (container dead or marked for removal) fails the user step

EARS SPEC: - If the sandbox container's logs cannot be read because the container is being removed after it exited, then run_shell_in_sandbox shall still return the exit code and the stdout/stderr it captured, or retry the read, and shall not turn a sandbox infrastructure error into a failed user step. - The sandbox runner shall be the only remover of its containers until both log reads complete. EVIDENCE (deploy #1056, 2026-10-23): demo matrix fork_join_stress run 9d7240d6-293f-4066-a640-d42e47146919, branch fork_0 (sleep 0.0 && echo fork_0) failed attempt 1 with docker.errors.APIError 409 Conflict 'can not get logs from container which is dead or marked for removal' at enterprise/tools/sandbox_exec.py:178 (_run_container: wait, stdout logs OK, stderr logs 409, remove in finally; no auto_remove). 1 in 4 runs; 3 re-runs passed. Remover not identified (docker events rotated). engine/tools/internal/reaper.py filters highway.type=sandbox, not highway.sandbox, so it is not the reaper by code. SYNTHESIS: domain = container lifecycle / exactly-one owner; concept = read logs once via attach/wait-with-logs (single demux stream) or retry on 409 with captured stdout. Alternatives to evaluate: (a) single logs(stdout=True, stderr=True, demux) call after wait [likely], (b) retry 409, (c) container.attach before start.