feat: complete Express provider lifecycle and explicit application invocation #152

Problem Description

At main daabf3c standard Sandbox implements pause/network/snapshots, but typed ProviderSandbox.pause/resume fails the operation gate and the old resume path does not rebind sessions. ProviderSandbox drops the separate traffic token. Application commands.run reserves timeout, preventing a business argument with that name.

Proposed Solution

Preserve standard APIs and GET attach semantics. Use provider-owned pause/connect-based resume with credential/URL rebinding, explicit traffic-token attach input and an invoke(name, arguments, request_timeout=...) API that leaves run keyword meanings intact. Add the single canonical STS configuration source and share provider extensions through the engine.

Acceptance criteria

• Same previously-used object can execute and read/write after pause/resume.
• No hidden connect/resume/TTL mutations in attach/application_client.
• Preserve known traffic token across GET responses; omit it from repr/default serialization/session files and use only its gateway header.
• Explicit invoke carries timeout/name/arguments/server_port business keys; old run remains compatible.
• Canonical ALIBABA_CLOUD_SECURITY_TOKEN, no revival of retired aliases, synchronized consumer export.
• Thin access to declared runtime extensions without duplicate cloud mappings.
• Regressions, real components, cleanup, full required checks, bilingual docs and owner records.

Node cloud client expansion is outside this change; companion Node application command APIs stay within its existing HTTP scope.