feat(cli): warn when credential-only provider type is used as sandbox entrypoint command

[aslanshi]

Problem Statement

Summary

When a user runs openshell sandbox create -- nvidia, the CLI:

1. detect_provider_from_command() in openshell-providers matches the command basename against normalize_provider_type() — it correctly identifies nvidia as a known provider type and auto-attaches it
2. The sandbox is created successfully
3. The same command string is then used as the sandbox entrypoint, which fails with /bin/bash: line 1: nvidia: command not found

The problem is that detect_provider_from_command() treats all recognized provider types equally — it doesn't distinguish between agent binaries (claude, codex, copilot, opencode) that are actually installed in the sandbox image and credential-only types (nvidia, openai, anthropic, github, gitlab, outlook, generic) that have no corresponding binary. The sandbox is actually fine, but the error makes it look like something went wrong.

Reproduction

openshell sandbox create --name test -- nvidia
# Output: Created sandbox: test
# Then: /bin/bash: line 1: nvidia: command not found

Proposed Design

Expected behavior

The CLI should warn the user when the command they passed is a recognized provider type but not a known agent binary. Something like:

⚠ "nvidia" is a credential provider type, not a runnable agent.
The nvidia provider was auto-attached, but there is no "nvidia" binary in the sandbox.
Did you mean: openshell sandbox create --provider nvidia -- claude

Proposed fix

1. Add an is_agent_binary() function in crates/openshell-providers/src/lib.rs that distinguishes runnable agent types from credential-only types
2. In crates/openshell-cli/src/run.rs sandbox_create(), after detect_provider_from_command() resolves the type (line ~2019), check is_agent_binary() and emit a warning if the command is credential-only

This keeps the auto-discovery working (the provider still gets attached) but gives the user a clear signal before the confusing command not found error.

Relevant code

• detect_provider_from_command(): crates/openshell-providers/src/lib.rs:146
• normalize_provider_type(): crates/openshell-providers/src/lib.rs:127
• sandbox_create() provider inference: crates/openshell-cli/src/run.rs:2019

Alternatives Considered

The design helps reduce user confusion and essentially strengthening codebase robustness.

Agent Investigation

No response

Checklist

• I've reviewed existing issues and the architecture docs
• This is a design proposal, not a "please build this" request