orchestrator: no CLI to inspect active NBD devices; lsblk shows 4096 pre-allocated noise

Problem

On a sandbox node, running lsblk | grep nbd | wc -l returns 4096 — one line per pre-allocated device. All show SIZE=0B when idle, making it impossible to quickly identify which devices are actively connected to a sandbox.

# current operator experience
$ lsblk | grep nbd | wc -l
4096

# no easy way to filter to just connected ones

The 4096 devices are expected — start-client.sh loads the nbd module with nbds_max=4096 and this is persisted in /etc/modprobe.d/nbd.conf. This is correct behavior. The problem is observability: there is no tool to see which of those 4096 slots are actually in use.

What exists today

pkg/sandbox/nbd/pool.go already has the machinery:

• ConnectedDevices() — scans /sys/block/nbdX/pid and returns only connected slots
• DevicePool.usedSlots — a bitset of pool-tracked slots (not accessible externally)
• OTEL metrics: orchestrator.nbd.slots_pool.acquired/released/ready — aggregate counts only

None of this is exposed via a CLI or debug endpoint. When a kernel I/O error like block nbd316: Receive control failed appears in dmesg, there is no way to correlate nbd316 to a sandbox ID.

Missing pieces

1. No CLI tool that calls ConnectedDevices() and prints a table of active devices (slot, path, size, PID) — analogous to cmd/inspect-build
2. No slot → sandbox ID mapping in DevicePool — even internally, usedSlots only tracks which slots are occupied, not which sandbox occupies each slot
3. DevicePool doesn't store maxDevices — callers must re-read /sys/module/nbd/parameters/nbds_max to know the pool ceiling

Proposed fix

Add cmd/inspect-nbd: a lightweight operator tool that shows only active NBD devices.

Example output:

NBD devices: 3 connected / 4096 configured

SLOT   DEVICE      SIZE (MB)  PID
3      /dev/nbd3   1024       18234
17     /dev/nbd17  2048       18891
316    /dev/nbd316 1024       19012

Flags: -json for machine-readable output.

Secondary improvement: store maxDevices on DevicePool at construction (avoids re-reading sysfs on every call) and expose a Status() method returning used/max counts for future debug endpoints.

Slot → sandbox ID mapping is left as follow-up work.

Start with pkg/sandbox/nbd/pool.go, especially ConnectedDevices and DevicePool construction, then compare the entry point and conventions in cmd/inspect-build. Done means cmd/inspect-nbd reports connected slots with device, size, and PID, supports -json, and includes the proposed pool status and configured maximum handling.