feat: include runtime policy revisions in sandbox get output

[cjagwani]

Summary

openshell sandbox get <name> returns the immutable baseline policy from sandbox creation time. Network policies added post-creation via openshell policy set are stored in the sandbox_policies runtime table but are not reflected in sandbox get output.

This forces downstream tools (NemoClaw) to call both sandbox get and policy get --full and stitch the output together to show users the actual enforced policy.

Request

Add an option to openshell sandbox get that includes the live runtime policy revisions in the output. For example:

openshell sandbox get <name> --include-runtime-policy

Or always include the latest runtime policy in the output alongside the baseline.

Context

• NemoClaw PR #1871 works around this by parsing sandbox get output, finding the Policy: section, and replacing it with policy get --full output.
• This works but is fragile — it depends on the exact output format of sandbox get.
• A first-class flag would eliminate the workaround and prevent breakage if the output format changes.

Related

• NemoClaw issue: network policy for slack won't apply NemoClaw#1132
• NemoClaw fix: fix(status): show live enforced policy instead of stale baseline (#1132) NemoClaw#1871