docs: regenerate mesh block with the shared CLI driver

packages/shared/sandbox-engine.ts is the shared driver the plugin packages
build on and the most CLI-coupled code in the mesh, so a command or flag
rename lands there first. Add it to the integrations table.

fix(sandbox): preflight running status for live commands (#86)

fix(sandbox): send SIGINT for managed PTY Ctrl-C (#85)

feat: image run using - sandbox `run` (#83)

* feat(sandbox): add docker-style run command

* fix(sandbox): clarify network attach order

* fix(sandbox): limit network detach picker to members

* fix(sandbox): show device counts in network picker

* fix(sandbox): address run command lint

* docs: add sandbox run usage

feat: make CLI tables responsive (#79)

* feat: make CLI tables responsive

* fix: preallocate sandbox list table

fix(sandbox): pin ssh known_hosts to sandbox id (#76)

Tunnel mode writes `HostName 127.0.0.1` for every sandbox, so all
sandboxes share one known_hosts identity. After the first box is
recorded, the next one presents a different host key on the same
`[127.0.0.1]:22` entry and ssh reports REMOTE HOST IDENTIFICATION HAS
CHANGED. OpenSSH downgrades that to a warning when public-key auth is
used, but stricter clients treat a changed host key as an attack and
refuse the connection outright. Orca's SSH relay is one of them, which
makes a second CreateOS sandbox unusable as a remote host.

VPN mode has the same defect with a longer fuse: it keys on the overlay
IP, and those are recycled between sandboxes.

Add `HostKeyAlias <sandbox-id>` to both blocks. OpenSSH then keys
known_hosts on the sandbox id, which is unique and stable across
pause/resume, instead of on a shared address.

Reproduced against sb-01m0hp7v5vtdnj2pwpj25drhwe while integrating
CreateOS sandboxes as Orca remote hosts.

feat(sandbox): match sandbox refs by ID or name prefix (#73)

Passing a partial sandbox ID did nothing useful: resolveSandboxRef
returned any `sb-` prefixed ref verbatim, so `sandbox rm sb-01243e`
reached the API as a literal and came back "not found".

Resolve refs the way Docker resolves container refs. Precedence runs
most-specific first: exact ID, unique ID prefix, exact name (newest
wins on duplicates, as before), then unique name prefix. A prefix
matching several sandboxes is refused with the candidates listed
rather than guessed at, which matters most for `rm`.

All 17 sandbox subcommands already funnel through resolveSandboxRef,
so no call sites change. The matching rules move into a pure
matchSandboxRef so they can be unit-tested: SandboxClient wraps a live
resty client and offers no mock seam.

Two details worth keeping:

Errors are *api.APIError, not fmt.Errorf. api.UserMessage rewrites
every other error type into a generic "something went wrong", and
rm.go prints resolve failures through it, so a plain error would have
been swallowed on exactly the command that needs it most. The
pre-existing not-found error had the same defect and is fixed too.

An ID that matches nothing is still returned verbatim, and an
ID-shaped ref survives a failed list call. The visible list is capped
at 200 rows, so the API must stay the authority on whether an ID
exists instead of the CLI inventing a not-found.

fix: sanitize error messages to prevent leaking internal details

- Remove raw HTTP response bodies and status codes from OAuth errors
- Replace all %v error prints with api.UserMessageVerbose() which
  returns the APIError message when available or a safe generic
  fallback otherwise
- Add debug: line with raw error when CREATEOS_DEBUG is set
- Replace pterm table render errors with generic message
- Replace TUI catalog/skills error displays with generic message
- Add Hint() display for API errors in main.go

fix(network): ask for network before device in attach/detach

Swap the interactive prompt order and positional arg order so the
network is selected first, then the sandbox or device. Updates
ArgsUsage, usage hints, and README examples to match.

fix: resolve lint issues in sandbox create and tunnel commands