bug: local sandbox sessions fail to recover after host sleep

[drew]

User Story

As a developer running OpenShell locally, I want an attached sandbox to survive laptop sleep and wake, so that I can resume the same canonical process and workspace without recreating the sandbox.

Problem Statement

Local Docker, Podman, and VM gateways use non-expiring bootstrap credentials when gateway_jwt.ttl_secs is omitted, but launch-scoped gateway and Sandbox Protocol credentials currently fall back to a 15-minute lifetime. A laptop can remain suspended beyond that lifetime without giving the supervisor an opportunity to refresh. After wake, the sandbox transport can be closed as expired and sandbox connect does not recover an established SSH transport interruption.

This creates inconsistent local behavior: start, stop, and exec establish fresh command paths, while an interactive connect session can exit or fail to reattach after sleep.

Impact / Why This Matters

Developers lose long-running interactive sessions merely by closing a laptop. The practical workaround is to rerun commands, restart components, or recreate the sandbox, which can discard process state and interrupts the expected persistent-sandbox workflow. Increasing a finite TTL only changes how long the laptop may sleep before failure and does not make local sessions robust.

Acceptance Criteria

• Omitting gateway_jwt.ttl_secs on local Docker, Podman, and VM gateways produces non-expiring launch-scoped gateway credentials.
• The same omission produces non-expiring Sandbox Protocol credentials and propagates that state through refresh responses and clients.
• Non-expiring credentials do not schedule an immediate or finite sandbox connection deadline.
• Shared deployments can continue to configure positive credential TTLs, and Kubernetes retains its positive default.
• sandbox connect retries an established SSH transport failure for a bounded period and reattaches to the same canonical main process.
• Initial authentication failures, sandbox lifecycle failures, and clean process exits are not retried.
• Automated tests cover non-expiring credential propagation, gateway restart or stop-start behavior, and forced SSH transport recovery.

Reproduction Steps

1. Start a local Docker, Podman, or VM gateway with gateway_jwt.ttl_secs omitted.
2. Create a persistent sandbox with a long-running canonical main process.
3. Attach with openshell sandbox connect.
4. Suspend the host laptop for longer than 15 minutes.
5. Wake the laptop and attempt to continue or reconnect to the same sandbox.
6. Observe that the interactive connection exits or cannot resume even though lifecycle commands may still establish fresh command paths.

Environment

• OpenShell: main before PR fix(sandbox): preserve local sessions across host sleep #3573
• OS: laptop host with suspend and resume
• Runtime, deployment, or integration: local Docker, Podman, or VM gateway

Proposed Fix

Propagate the local non-expiring JWT configuration to both launch-scoped credential profiles and supervise the SSH child used by sandbox connect, allowing bounded transport recovery and reattachment to the same canonical process.

Implementation: #3573