Phase 2 slice 9: Migrate sandbox logs and settings to SDK and gRPC

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Use the curated SDK and main-service gRPC client for sandbox log retrieval, log following, and sandbox-scoped settings that satisfy the Phase 1 contracts.

## Draft scope

- Use the curated SDK for sandbox-scoped setting updates with equivalent type and scope semantics.
- Use released main-service RPCs for sandbox log retrieval and watch streams.
- Preserve current audit-log enablement, tail, since, follow, cancellation, and error behavior.
- Map stream events and protobuf messages to NemoClaw-owned log records and typed errors.
- Keep installed CLI version checks and local executable diagnostics on the CLI.
- Run shared logs and settings contracts against the selected implementations.

## Acceptance evidence

- Supported setting value types do not change through string conversion.
- Sandbox scope cannot be confused with gateway scope.
- Tail, since, follow, cancellation, stream termination, and backpressure preserve the current behavior contract.
- Invalid setting, missing sandbox, authorization failure, and transport ambiguity remain distinct.
- Logs and errors redact credentials and credential-bearing environment values.

## Test plan

- Shared CLI, SDK, and gRPC logs and settings contracts.
- SDK tests for setting conversion, scope, timeout, cancellation, and typed errors.
- gRPC stream tests for ordering, termination, backpressure, cancellation, and redaction.
- Existing logs, runtime-identity, policy, status, and diagnostics tests.
- Focused live evidence for effective setting application and log following.

## Dependencies and sequencing

Blocked by Phase 2 Slice 1.

## Deferred scope

- Installed CLI version checks.
- Local executable and process diagnostics.
- Log operations without released RPC parity.