fix(sandbox): complete successful main processes

[drew]

Summary

Restore ephemeral canonical-command semantics for sandbox create. The canonical main process controls the sandbox lifecycle, and foreground create streams output and returns the command exit code.

Related Issue

Closes #2879

Changes

• Add the public Completed sandbox phase across protobuf, SDK, CLI, and TUI surfaces.
• Map exit code 0 to Completed/MainProcessCompleted.
• Map nonzero and signal-normalized exits to Error/MainProcessFailed, preserving the exact exit code. For example, SIGINT is reported as 130.
• Keep explicit sandbox stop as Stopped/SandboxStopped.
• Distinguish infrastructure errors from command failures by condition reason and the absence of a main-process exit result.
• Keep the supervisor relay available long enough to attach to fast commands and drain retained output.
• Send the SSH exit result only after the gateway durably records the terminal phase and exit code.
• Make explicit create commands foreground by default; --detach remains available for long-running workloads.
• Delete --no-keep sandboxes only after stdout, stderr, and the command result have drained.
• Preserve restart and stale-instance fencing for retained terminal sandboxes.
• Update lifecycle tests, architecture documentation, user documentation, and the OpenShell CLI skill.

Testing

• mise run pre-commit
• cargo test -p openshell-server --lib -q — 1,415 passed, 8 ignored
• OPENSHELL_E2E_DOCKER_TEST=sandbox_lifecycle mise run e2e:docker — 7 passed
• Supervisor and CLI lifecycle tests
• Python type checking and tests — 89 passed
• mise run sdk:ts:ci
• Go SDK tests and generated-protobuf checks
• GitHub branch checks on Linux amd64, Linux arm64, and macOS

Checklist

• Follows Conventional Commits
• Commits are signed off for DCO
• User-facing and architecture documentation updated
• Sandbox infrastructure E2E exercised

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2884.docs.buildwithfern.com/openshell