feat(sdk): accept a sandbox policy in the Rust SDK's SandboxSpec #5410

User Story

I write testkit tests that create a sandbox with a policy. I want the Rust SDK's SandboxSpec to accept a policy, so testkit uses the SDK's own create request instead of rebuilding it, and a policy works together with a GPU or service exposures.

Description

openshell_sdk::SandboxSpec has no policy field. To create a sandbox with a policy, testkit's SandboxBuilder::create (tests/testkit/testkit/src/context.rs, policy_create_request) builds the CreateSandboxRequest itself, mirroring the SDK's create_sandbox_request (crates/openshell-sdk/src/client.rs). It destructures SandboxSpec without .., so a new SDK field fails to compile there instead of being dropped, but the mapping is still duplicated. It doesn't map gpu or service_exposures, so create rejects a sandbox that combines them with a policy.

Evan raised this in the review of #5318.

Open question: the curated SandboxSpec avoids generated wire types and points callers to openshell_sdk::raw for the full proto surface. The field could take the proto SandboxPolicy, policy YAML, or a curated policy type.

Context

• crates/openshell-sdk/src/types.rs: SandboxSpec.
• crates/openshell-sdk/src/client.rs: create_sandbox_request.
• tests/testkit/testkit/src/context.rs: SandboxBuilder::policy, policy_create_request, and the GPU and service-exposure check in create.

Definition of Done

• SandboxSpec (or the SDK's create API) accepts a sandbox policy, with the type choice recorded here.
• create_sandbox_request sets spec.policy from it, with a unit test.
• testkit passes the policy through the SDK and deletes policy_create_request and the GPU and service-exposure restriction.