refactor(cli): replace sandbox_create positional args with SandboxCreateConfig struct

[lunarwhite]

Summary

Replace the 21-parameter positional signature of run::sandbox_create with a SandboxCreateConfig struct, following the ProviderRefreshConfigInput precedent established in PR #1349. This removes the clippy::too_many_arguments suppression and makes call sites self-documenting via named fields and struct update syntax.

Related Issue

Closes #1408

Notes for reviewers:

The original issue suggested a builder pattern (SandboxCreateBuilder::new(...).name(...).create().await?).
This PR proposes to use a plain config struct with Default instead, for two reasons:

1. Precedent: ProviderRefreshConfigInput (PR feat(providers): add credential refresh foundation #1349, merged after the issue was filed) established a config-struct convention in the CLI crate, while no builder pattern exists in crates/openshell-cli/.
2. Fit: sandbox_create is an async side-effecting operation, not an inert value construction. A builder would require ~18 setter methods for the same named-field ergonomics that SandboxCreateConfig { ..Default::default() } provides for free. The struct approach solves the stated problem (positional args, readability, fragility) while
   staying consistent with the codebase.

Changes

• Introduce SandboxCreateConfig<'a> struct with Default impl (safe production defaults: keep: false, approval_mode: "manual")
• Refactor sandbox_create() to accept (server, gateway_name, config, tls), keeping infrastructure params positional per existing convention
• Update the CLI dispatch in main.rs to construct the config struct
• Add test_config() helper in integration tests with test-appropriate defaults (keep: true, tty_override: Some(false)) and migrate all 14 call sites
• Net reduction of ~90 lines through struct update syntax

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[elezar]

Should this be marked test-only?

[lunarwhite]

Thanks for reviewing this PR! The file is under tests/ subfolder, which is a separate crate that won't be compiled into the binary. So I assume it's not required.

[elezar]

/ok-to-test 83637ad

[elezar]

Not that it's too important, but can one specify this inline?

[lunarwhite]

I don't have a preference. Looking at the broader codebase style, not-inline seems to be the more adopted pattern. If you don't have a strong preference on this either, I'll leave it as-is for now. 🙂