Fail Sandbox Run

Mark a run as failed when the agent itself catches an unrecoverable error.

Args: run_id: Run UUID from the path. body: {"error_message": "..."}. callback_token: One-time token issued at run creation.

Raises: HTTPException 401: Token invalid or run already finalized. HTTPException 404: Run not found.