fix(server): register the plugin worker manager per process so run dispatch cannot lose it - #306

The bug, for the third time

Runs fail with:

Failed to acquire lease for environment "Kubernetes Sandbox" (sandbox): Sandbox provider "kubernetes" is installed, but sandbox plugin workers are unavailable in this server process.

Seen on production 2026-07-26: three runs for one company, dispatched by assignment and automation, failing in 0.37s to 0.42s. Sub-second is the diagnostic tell for a wiring gap; a genuinely absent worker polls pluginWorkerReadyTimeoutMs (5s) first.

Why patching call sites has not worked

The plugin worker manager is process-scoped, which is what the message itself says. But it is threaded as an optional parameter through six environmentRuntimeService construction sites and dozens of route mounts. Any caller that omits it builds a run engine that can never acquire a sandbox lease, and the omission is invisible until a customer hits that exact path.

#304 fixed three route mounts. It could not fix these, which pass no options at all:

• server/src/routes/activity.ts:25
• server/src/routes/instance-settings.ts:31
• server/src/routes/summary-slots.ts:31
• server/src/services/companies.ts:59

heartbeatService forwards options.pluginWorkerManager straight into environmentRuntimeService (heartbeat.ts:5594), so heartbeatService(db) yields a manager-less runtime. That is the path assignment and automation take.

The fix

Register the manager once at app construction, and have the sandbox driver fall back to it:

// createSandboxEnvironmentDriver
const pluginWorkerManager = options.pluginWorkerManager ?? getProcessPluginWorkerManager();

Every dispatch path funnels through createSandboxEnvironmentDriver, so one fallback covers all of them, including any construction site added in future.

Properties kept deliberately:

• An explicitly passed manager still wins, so existing tests keep injecting their own and are unaffected.
• No manager is still not a crash. Contexts that legitimately have none (migrations, CLI entrypoints, unit tests that never dispatch) get the same accurate, non-retryable error as before. isSandboxProviderWorkerUnavailableFailureMessage matches on message text, so retry classification is unchanged.

Alternative considered

Making pluginWorkerManager required in the types would be compile-time enforced, but it is a far larger change across every construction site, breaks contexts that genuinely have no worker, and is still bypassable with undefined as any.

Tests

New server/src/__tests__/plugin-worker-process-registry.test.ts, 5 cases: empty registry returns undefined, registration round-trips, re-registration replaces, an explicit undefined is treated as absent rather than throwing, and an explicitly passed manager takes precedence over the process registration.