v0.10.1 — periodic safety-net purge for ephemeral workspaces

v0.10.0's per-request /tmp/aicodebox/<uuid>/ cleanup runs in a
`finally` block — covers the normal case but not SIGKILL, container
restart with a leftover root, or the cleanup helper itself raising.
In those cases orphans leaked forever.

v0.10.1 adds purge_stale_workspaces(): iterates
EPHEMERAL_WORKSPACE_ROOT, removes dirs older than 1h (TTL covers
worst-case schema runs 10x over), skips non-dir entries, returns
the purged count, WARN-logs skipped/failed entries. Wired into
server._purge_loop which runs every 10 minutes.

Bonus: purge_stale_uploads now WARN-logs its silently-swallowed
OSError path.

167 tests pass (+3 new for the orphan removal, missing-root no-op,
and stray-file skip cases).

Migration: none. Existing v0.10.0 deployments accumulate stale
dirs until restarted; v0.10.1 sweeps them on first purge tick.