chore: refactor sandbox_create to use a builder pattern

[drew]

Description

run::sandbox_create in crates/openshell-cli/src/run.rs has grown into a large positional-argument API. Call sites now pass many None, false, Some(false), empty slice, and empty map values, which makes tests and CLI dispatch hard to read and easy to break when parameters are added or reordered.

Example current call shape:

run::sandbox_create(
    &server.endpoint,
    Some("vm-error"),
    None,
    "openshell",
    None,
    true,
    false,
    None,
    None,
    None,
    None,
    &[],
    None,
    None,
    &["echo".to_string(), "OK".to_string()],
    Some(false),
    Some(false),
    &HashMap::new(),
    &tls,
)

Context

Observed locations:

• crates/openshell-cli/src/run.rs: sandbox_create currently takes 19 parameters and has #[allow(clippy::too_many_arguments)].
• crates/openshell-cli/src/main.rs: CLI dispatch builds the positional call from parsed command state.
• crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs: integration tests repeat long calls where only a few fields vary.

Proposed Work

Introduce a typed SandboxCreateOptions/SandboxCreateBuilder API for sandbox creation, then update the CLI and tests to construct options by field name instead of relying on positional arguments.

Possible shape:

run::SandboxCreateBuilder::new(&server.endpoint, &tls)
    .gateway_name("openshell")
    .name("vm-error")
    .keep(true)
    .command(["echo", "OK"])
    .tty_override(false)
    .auto_providers_override(false)
    .create()
    .await?;

The exact type names and ownership model should follow the existing CLI code style. Preserve existing sandbox_create behavior while moving the argument list into a single structured config.

Definition of Done

• Replace the large positional sandbox_create signature with a builder/options-based API.
• Remove the local clippy::too_many_arguments allowance for this method.
• Update crates/openshell-cli/src/main.rs to construct the request through named fields/builder methods.
• Update integration tests to use the new builder or concise test helpers.
• Preserve existing sandbox create behavior, including keep/no-keep, forwarding, provider inference, resource limits, labels, TLS, and command handling.
• Run the relevant CLI tests, at minimum cargo test -p openshell-cli sandbox_create or the equivalent mise task.