feat: session timeout — auto-stop idle containers

[thejoeejoee]

Forgotten workspaces run indefinitely, consuming CPU, memory, and Docker daemon resources. There's no mechanism to auto-stop containers after a period of inactivity.

Proposal

Add a workspace-level config for idle timeout:

[defaults]
idle_timeout = "4h"       # stop after 4 hours idle, default: "" (disabled)

[workspaces.ephemeral-task]
idle_timeout = "30m"

When idle_timeout is set:

• jailoc tracks last activity timestamp (container exec, attach session, or opencode HTTP request)
• A background check (either a goroutine in a long-running daemon, or a periodic health-check-based approach) compares current time against last activity
• If idle time exceeds the configured threshold, jailoc down is triggered for that workspace
• jailoc status shows remaining idle time: idle: 23m / 30m

Activity signals to consider

• docker exec sessions (attach)
• HTTP requests on the opencode port (remote mode)
• Container process activity (CPU usage above threshold)

Implementation options

1. Health check + label approach: Store timeout in container labels, use a cron/launchd job or a jailoc gc subcommand that checks all running workspaces
2. Daemon approach: A jailoc daemon background process that monitors and reaps idle workspaces
3. Container-side approach: Set a watchdog inside the container that signals exit after idle time

Option 1 (periodic jailoc gc) is simplest and aligns with jailoc being a CLI tool, not a daemon.

Why

• E2B caps sessions at 24h for this exact reason
• Prevents resource waste on shared machines
• Safety net for jailoc up without a matching jailoc down