feat(ai-red-teaming): tear down provisioned environments on assessment completion

[rdheekonda]

Problem

Hosted sandboxes bill for their whole lifetime, but the ai-red-teaming capability provisioned them and never tore them down. provision_environment created a TaskEnvironment, returned its /attack URL, and dropped the handle - nothing ever called teardown(), and it did not even surface the environment id. A TUI red-teaming session would leak its sandbox, which kept billing until the platform TTL reaped it (~30 min after the attack finished).

This is capability-only (no SDK/platform changes).

What changed

Added an environment lifecycle to the capability:

• Session registry (tools/environments.py) - a file-based record (AIRT_ENV_REGISTRY_PATH, default /tmp/airt_environments.json) of every provisioned environment, so teardown works across separate tool invocations in one session.
• provision_environment now registers the sandbox and returns its id.
• teardown_environment(environment_id?, older_than_sec) - new tool. Reaps one env or the whole session. Idempotent (an already-gone env counts as torn down). older_than_sec is a grace window so a still-running attack is not killed.
• Auto-teardown on completion - update_assessment_status reaps the session registry the moment it flips the assessment to completed. Best-effort: teardown failure never breaks status recording. AIRT_ENV_TEARDOWN_GRACE_SEC (default 0) keeps very recently provisioned sandboxes alive so a trailing attack finishes.
• Backstop unchanged - the sandbox timeout_sec still reaps if completion never fires.
• Agent prompt documents both tools.

Bumps capability 1.11.0 -> 1.12.0 (immutable content requires a version bump).

Tests

tests/test_environments_teardown.py - 17 new unit tests (all pure, no network):

• Registry add/dedup/load-tolerance.
• Teardown: all / single-id / missing-env-is-success / provider-error-kept-for-retry / grace-window skip+reap / empty-registry no-op.
• Session helper short-circuits without a platform call when nothing is registered.
• Completion hook: fires once on completion, not on partial progress, not on repeat updates; real hook returns empty with no registry.

Validation

• pytest tests/test_environments_teardown.py tests/test_assessment_tracker.py -> 24 passed.
• Full capability suite: 194 passed, 1 skipped, 1 pre-existing failure (test_attack_runner.py::TestGenerateMultimodalAttack::test_generates_compiling_script_with_image) confirmed failing on origin/main, unrelated to this change.