feat: include runtime policy revisions in sandbox get output

[cjagwani]

Summary

openshell sandbox get <name> returns the immutable baseline policy from sandbox creation time. Network policies added post-creation via openshell policy set are stored in the sandbox_policies runtime table but are not reflected in sandbox get output.

This forces downstream tools (NemoClaw) to call both sandbox get and policy get --full and stitch the output together to show users the actual enforced policy.

Request

Add an option to openshell sandbox get that includes the live runtime policy revisions in the output. For example:

openshell sandbox get <name> --include-runtime-policy

Or always include the latest runtime policy in the output alongside the baseline.

Context

• NemoClaw PR fix(gateway): gate unsafe auth deployment modes #1871 works around this by parsing sandbox get output, finding the Policy: section, and replacing it with policy get --full output.
• This works but is fragile — it depends on the exact output format of sandbox get.
• A first-class flag would eliminate the workaround and prevent breakage if the output format changes.

Related

• NemoClaw issue: network policy for slack won't apply NemoClaw#1132
• NemoClaw fix: fix(status): show live enforced policy instead of stale baseline (#1132) NemoClaw#1871

[johntmyers]

Since we already have a way to retrieve an arbitrary rev of a policy, we should just make sure openshell sandbox get ... always returns the currently running effectively policy. We should also update the metadata to signal if the policy is for the specific sandbox or coming from a global policy (which will override a sandbox policy). Additionally, we should explore a flag that delivers only the YAML of the running policy so it's easier to extract vs always having to parse the metadata + policy body.