fix(sandbox): real creds when no tls:terminate

[ericcurtin]

Summary

Without a tls: terminate endpoint in the sandbox policy, the proxy cannot intercept HTTPS traffic to rewrite credential placeholders in request headers. Placeholder values reached upstream APIs verbatim, causing 401 errors and immediate process exit (e.g. openshell sandbox create -- claude exiting right after the Claude Code wizard appeared).

Related Issue

N/A

Changes

• Skip placeholder mechanism when policy has no tls: terminate endpoints; pass real provider credentials directly to child process
• Emit a warning log directing operators to add protocol: rest and tls: terminate to HTTPS endpoints for secure credential rewriting
• Add has_tls_terminate_endpoints field to SandboxPolicy populated from the proto network policy at startup
• Update testdata/sandbox-policy.yaml to configure api.anthropic.com:443 with correct protocol, tls, and enforcement fields

Testing

• mise run pre-commit passes
• Unit tests added/updated (285 pass, 0 failed)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

Thank you for your interest in contributing to OpenShell, @ericcurtin.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[ericcurtin]

I have read the DCO document and I hereby sign the DCO.

[ericcurtin]

recheck