Phase 2 slice 5: Migrate sandbox lifecycle to SDK and gRPC

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Use the curated SDK and main-service gRPC client for sandbox lifecycle mutations that satisfy the Phase 1 lifecycle contract.

## Draft scope

- Map curated SDK create and delete operations to NemoClaw-owned lifecycle requests and results.
- Use released start and stop RPCs when current consumers require them and the curated SDK has no equivalent.
- Prove parity for each migrated image, label, environment, provider, GPU, policy, resource, and advanced-spec field.
- Preserve create, wait, rollback, delete, absence verification, and cleanup ordering.
- Select one transport for each lifecycle operation.
- Retain CLI composition for local image builds, create-time upload, terminal behavior, and detached forwarding when no equivalent RPC exists.

## Acceptance evidence

- Successful creation reaches the expected observed state with the intended policy and provider configuration.
- Delete success requires authoritative absence evidence.
- Transport ambiguity after create, start, stop, or delete is reconciled before retry, rollback, or cleanup.
- Failed create, rollback, cancellation, rebuild, and cleanup preserve Phase 1 state transitions.
- No lifecycle mutation uses automatic cross-transport fallback.

## Test plan

- Shared CLI, SDK, and gRPC lifecycle contracts.
- Conversion and error tests for every migrated lifecycle input.
- Existing onboarding, rebuild, destroy, rollback, uninstall, GPU, and recovery tests.
- Focused lifecycle E2E evidence against the exact selected gateway and runtime.

## Dependencies and sequencing

Blocked by Phase 2 Slices 1 and 3.

## Deferred scope

- Local Dockerfile builds and build-context preparation.
- Create-time upload and detached port forwards.
- Deletion of CLI lifecycle methods until every migrated path has merged evidence.