feat: add sandbox workflows and group agent commands

[EItanya]

Agents can now use standalone Sandboxes for their own scripts, tests, and file processing through kagent sandbox. Template discovery, lifecycle, execution, and file transfer live under that command so the full workflow is discoverable through one help entry.

Agent commands follow the same grouping:

• kagent agent list and kagent agent get NAME discover agent definitions.
• kagent agent invoke --session ID --task ... invokes an existing conversation through A2A.
• kagent agent session create, list, get, and delete manage conversations.
• kagent agent template list and get discover reusable AgentTemplates.

These replace the previous top-level get, create, delete, and invoke paths. List commands own pagination flags, and get commands require an explicit name or ID. apply -f FILE remains shared by Agents and AgentTemplates. The skill, TUI hints, documentation, and CLI E2E tests use the new paths. Existing transports are preserved: agent/template discovery uses Kubernetes, session lifecycle uses the kagent API, and invocation uses the gateway.

The sandbox CLI uses the existing authenticated connection and calls the lifecycle, process, and filesystem gRPC APIs directly. File transfers stream up to the API's 64 MiB limit. Creation requires a retained request ID, process starts are never automatically retried, and interrupted waits preserve the process ID and output offsets. Execution returns the remote exit code, supports JSON events, and downloads replace the local destination only after a complete transfer.

The kagent skill walks agents through choosing an environment, staging inputs, verifying results, collecting artifacts, and cleanup. It prefers the configured CLI when available and includes exact MCP examples. The MCP server advertises workflow instructions, expands tool descriptions, and adds sandbox-task and sandbox-recovery prompts. Clients must request these prompts; tool descriptions carry the essential guidance for clients that only consume tools.

Validation:

• go test -race ./api/client ./core/cli/... ./core/internal/mcp passed, including binary transfers larger than 1 MiB, interrupted transfers/waits, and a smoke test against the upstream guest library. CLI tests cover the command paths, required targets, pagination flags, and inherited output settings.
• Lint passed with zero issues for ./api/client ./core/cli/... ./core/internal/mcp ./core/test/e2e. CLI build, skill validation, and git diff --check passed.
• Sandbox lifecycle, execution, suspend/resume, and durable binary transfer passed in CI, along with the agent catalog, session lifecycle, and invocation E2E cases.
• HTTP streaming E2E tests now follow the existing explicit send-rejection contract: retry the same message only before any event and only when the gateway proves it was not accepted. Regression tests exercise JSON-RPC error decoding, request identity, ambiguous errors, partial streams, consumer cancellation, and deadlines. These pass with the race detector; E2E-package lint reports zero issues. The full live E2E suite and all PR checks passed on 8482b1c2 (CI run).