Phase 2 slice 7: Migrate sandbox provider attachments to the SDK

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Use the curated SDK for sandbox provider attach, list, and detach operations that satisfy the Phase 1 attachment contract.

## Draft scope

- Map curated SDK attach, list, and detach methods to NemoClaw-owned requests and results.
- Preserve resource version, idempotence, provider-derived policy, and cleanup ordering.
- Run shared attachment contracts against CLI and SDK implementations.
- Migrate eligible onboarding, recovery, rebuild, snapshot, and destroy consumers.
- Allow provider resources to remain CLI-managed until the provider-management slice migrates them.

## Acceptance evidence

- Attach, list, and detach return the same provider identity and changed or unchanged decision.
- Missing sandbox, missing provider, version conflict, authentication failure, and transport ambiguity remain distinct.
- A provider is not deleted while still attached. Detach cleanup preserves current ownership checks.
- Provider credentials do not enter SDK logs, errors, or typed results.
- Provider-derived policy remains applied and verified after attachment changes.

## Test plan

- Shared CLI and SDK provider-attachment contracts.
- SDK tests for resource versions, idempotence, error mapping, and redaction.
- Existing provider cleanup, snapshot, rebuild, messaging, and managed-provider tests.
- Focused gateway evidence for credential custody and provider-policy composition.

## Dependencies and sequencing

Blocked by Phase 2 Slice 1. This slice does not depend on gRPC provider management because the mixed transport remains valid during migration.

## Deferred scope

- Gateway provider credentials, profiles, and refresh.
- New provider attachment behavior.
- Deletion of CLI methods still used by non-migrated consumers.