bug: sandbox create leaves stale resource on ImagePullFailed, blocking retry

Agent Diagnostic

• Skills loaded: create-github-issue, openshell-cli
• OpenShell version tested: 0.0.101
• Latest release checked: unable to verify
• Known fixes reviewed: unable to verify
• Possible duplicates reviewed: searched "sandbox create failed cleanup stale", no results
• Findings: When sandbox create fails during provisioning (e.g., ImagePullFailed), the sandbox resource persists in error state. A retry with the same name fails with "sandbox already exists". The user must manually sandbox delete before retrying.
• Remaining reason for filing: Failed provisioning should not leave behind stale resources that block retries.

Description

Actual behavior: When sandbox create fails (e.g., due to image pull failure), the sandbox resource remains:

$ openshell sandbox create --name my-sandbox --from some-image:latest --no-tty -- echo ready
Error: × sandbox entered error phase while provisioning: ImagePullFailed: ...

$ openshell sandbox create --name my-sandbox --from some-image:latest --no-tty -- echo ready
Error: × sandbox 'my-sandbox' already exists
       hint: delete it first with: openshell sandbox delete <name>

Expected behavior: Either:

1. Auto-cleanup: if provisioning fails, the gateway should remove the sandbox resource so the name is available for retry, or
2. Offer --replace or --force flag that deletes an existing failed sandbox before creating, or
3. At minimum, detect that the existing sandbox is in error state and offer to replace it instead of just saying "already exists"

Reproduction Steps

1. openshell sandbox create --name test --from nonexistent-image:latest --no-tty -- echo ready
2. Observe the ImagePullFailed error
3. openshell sandbox create --name test --from valid-image:latest --no-tty -- echo ready
4. Observe "sandbox 'test' already exists" error

Environment

• OpenShell CLI: 0.0.101
• Gateway: 0.0.102-dev.4
• Compute driver: Docker