[ekellbuch]

What does this PR do?

Terminal-Bench 2.1, SWE-bench, and DeepSWE run setup commands after starting a task container. If setup raises an exception, the caller never receives the container handle. The task fails, but the container can remain running until expiry or manual cleanup.

AsyncSandbox.start_with_setup() starts the container, runs setup, and attempts to stop the container if setup raises. The three resources servers now use this shared helper. Successful setup and subsequent agent execution and verification are unchanged.

The helper handles exceptions, including cancellation. A nonzero command exit alone does not trigger cleanup. If stopping the container also raises, the cleanup exception propagates with the setup exception retained as Python exception context.

Checklist

• I have read the contributing guidelines.
• The change is focused; unrelated "drive-by" edits are tracked as separate issues/PRs.
• Tests added or updated and pass locally, or N/A for docs-only / non-code changes (so CI unit/server checks pass when applicable).
• Pre-commit checks pass locally (pre-commit run --all-files) (so CI lint/format/copyright pass).
• All commits have DCO sign-off (git commit -s) (so the DCO check passes).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[bxyu-nvidia]

/ok to test f3c4af8