Vouch request: jadenfix

[jadenfix]

What do you want to work on?

For #4111, Podman delete sandbox removes the managed workspace and channel volumes by generated name without checking ownership labels. The fix I propose inspects each volume first and keeps any volume that isn't labeled for that sandbox.

For #4046, sandbox create upload only checks Git filtering after the sandbox is ready, so a rejected upload leaves the sandbox running. The fix I've proposed plans every upload before provisioning starts.

Why this change?

For #4111, an unrelated volume that happens to have a matching name can be deleted and lose its data

For #4046, a sandbox gets created and has to be cleaned up by hand for an upload that could never have succeeded

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md