Phase 2 slice 4: Migrate exec and SSH sessions to the SDK

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Use the curated SDK for buffered exec, streaming exec, interactive exec, and SSH-session primitives that satisfy the Phase 1 command-transport contract.

## Draft scope

- Map SDK command, stream, interactive-session, and SSH-session results to NemoClaw-owned types.
- Run shared command and session contracts against CLI and SDK implementations.
- Migrate eligible consumers with explicit transport selection.
- Preserve stream ordering, exit events, timeout, cancellation, TTY, resize, stdin, and token revocation behavior.
- Retain terminal and OpenSSH connection behavior on the CLI where the SDK provides only primitives.

## Acceptance evidence

- Arguments, working directory, environment, stdin, stdout, stderr, and exit status remain equivalent.
- Remote nonzero exit, timeout, cancellation, transport failure, and truncated stream remain distinguishable.
- An interactive stream that ends without an exit event fails instead of becoming success.
- SSH tokens remain scoped and redacted. The implementation revokes them when the current lifecycle contract requires revocation.
- No ambiguous operation retries through the CLI.

## Test plan

- Shared CLI and SDK exec and session contracts.
- SDK tests for stream ordering, terminal exit, cancellation, resize, token validation, and error mapping.
- Existing command transport, session, connect, agent, and sandbox-version tests.
- Focused runtime evidence for interactive TTY and SSH trust boundaries.

## Dependencies and sequencing

Blocked by Phase 2 Slice 1.

## Deferred scope

- Rebuilding the complete CLI terminal experience.
- Upload, download, and detached port forwards.
- Deletion of CLI session methods used by terminal-specific paths.