feat(cloud-agent-next): add containers billing identity from instance size

[eshurakov]

Summary

Resolve a containers billing identity (class, service, SKU, capacity) from instance size. container-usage-context.ts becomes the sole owner of class ↔ service ↔ SKU ↔ capacity.

• Adds cloud-agent-containers-standard-3-2026-09 and cloud-agent-containers-standard-4-2026-09 to SANDBOX_USAGE_SKUS
• Adds CONTAINERS_BILLING_CAPACITIES (standard-3: 2 vCPU / 8 GiB / 16 GB; standard-4: 4 vCPU / 12 GiB / 20 GB)
• Adds containersBillingIdentity('standard-3'|'standard-4'); rejects lite/standard-1/standard-2
• Extends assertSandboxBillingAllocation so containers classes accept an isolated ses- billing ID
• Legacy snapshots stay identical except the deliberate SKU additions

Service strings use the existing camel→kebab transform (SandboxContainersStandard4 → cloud-agent-next-sandbox-containers-standard4); the transform is unchanged so every legacy service string is preserved.

No runtime/adapter/picker wiring in this PR.

Verification

• pnpm --filter cloud-agent-next exec vitest run src/container-usage-context.test.ts src/container-capacity-parity.test.ts — pass
• pnpm --filter cloud-agent-next typecheck — pass

Stack

Part 2 of 5. Previous: #6572.

1         extract metered billing lifecycle
2 (this)  containers billing identity from instance size
3         SandboxContainers adopts the billing lifecycle
4         activate containers billing admission + terminal enforcement
5         open Cloudflare containers selection under enforced billing

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Full re-review (history was rewritten, so the incremental base is no longer an ancestor of HEAD): the containers billing-identity work and its Object.hasOwn hardening introduce no new security, correctness, or performance issues; the only prior finding is fixed at HEAD.

Files Reviewed (5 files)

• services/cloud-agent-next/src/container-usage-context.ts
• services/cloud-agent-next/src/container-usage-context.test.ts
• services/cloud-agent-next/src/container-capacity-parity.test.ts
• services/cloud-agent-next/src/container-usage.ts
• services/cloud-agent-next/src/metered-billing-lifecycle.ts

Previous Review Summaries (2 snapshots, latest commit f08df04)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit f08df04)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/cloud-agent-next/src/container-usage-context.ts
• services/cloud-agent-next/src/container-usage-context.test.ts

Previous review (commit 6620472)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The billing-identity resolution added for Cloud Agent containers is sound; the only finding is a prototype-sensitive class-name check in container-usage-context.ts that is inconsistent with the hardened lookup in containersBillingIdentity.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/container-usage-context.ts	68	isContainersBillingClassName uses prototype-inclusive in instead of Object.hasOwn, so constructor/toString/__proto__ classify as containers classes through billingCapacityForSandboxClass and assertSandboxBillingAllocation.

Files Reviewed (5 files)

• services/cloud-agent-next/src/container-usage-context.ts - 1 issue
• services/cloud-agent-next/src/container-usage-context.test.ts
• services/cloud-agent-next/src/container-capacity-parity.test.ts
• services/cloud-agent-next/src/container-usage.ts
• services/cloud-agent-next/src/metered-billing-lifecycle.ts

Notes

• Verified that the move of usageServiceForSandboxClass into container-usage-context.ts leaves no stale imports and introduces no import cycle (metered-billing-lifecycle and container-usage import from container-usage-context, which does not import them back).
• Verified that no production code still indexes SANDBOX_CAPACITIES with a SandboxClassName that could now be a containers class; the only production consumer goes through billingCapacityForSandboxClass.
• Verified the kebab-case service strings and SKU strings, and that containersBillingIdentity capacity values match both the selectable instances and the sandbox-selection.ts labels the new parity test checks.
• Memory-leak check: the changed lines add only immutable constants, pure functions, and a read-only test that reads files synchronously; no timers, listeners, caches, or retained references were introduced.
• No markdown documentation files were changed, so the markdown-image rule does not apply.

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch eshurakov/containers-billing-c1-lifecycle}