feat(cli): restructure CLI commands for simpler UX

[drew]

Summary

Restructures the nemoclaw CLI to flatten deeply nested subcommands and improve discoverability, implementing all items from #114.

• Top-level promotions: nemoclaw status, forward, logs, policy now work directly instead of requiring sandbox prefix
• Gateway subcommand: New nemoclaw gateway start|stop|select|list replacing cluster admin deploy|destroy|select|list; hidden backwards-compat alias for cluster admin deploy with deprecation warning
• Upload replaces sync: --upload <local>[:<remote>] with .gitignore filtering by default (--no-git-ignore to disable); new sandbox upload/download subcommands for file transfer
• Graceful missing gateway: nemoclaw status prints a friendly message instead of erroring when no gateway is configured
• Gateway select UX: Running gateway select without args lists available gateways with a hint to run gateway select <name>

Command mapping (old → new)

Old	New
cluster admin deploy	gateway start
cluster admin destroy	gateway stop
cluster admin select	gateway select
cluster admin list	gateway list
sandbox status	status
sandbox forward	forward
sandbox logs	logs
sandbox policy get|set	policy get|set
sandbox create --sync	sandbox create --upload <path>[:<remote>]
(new)	sandbox upload <name> <path>
(new)	sandbox download <name> <remote> [local]

Files changed (22 files, +836 −579)

Core implementation: main.rs (enum restructure, routing, parse_upload_spec()), run.rs (signature changes, public helpers), bootstrap.rs (error messages)

Documentation: README, 6 architecture docs, 4 agent skills, 4 examples, 4 e2e tests/scripts

Testing

• All 50 Rust tests pass (26 lib + 13 bin + 2 mTLS + 6 provider + 3 sandbox name)
• Pre-commit suite passes (fmt, clippy, check, test, helm lint, license, python)
• New tests: parse_upload_spec_* (3 tests), sandbox_upload_uses_path_value_hint, sandbox_upload_completion_suggests_local_paths

Closes#114