fix(sandbox): stabilize canonical main process tests

[drew]

Summary

Fix the main-branch E2E regressions exposed after #2726 merged. Preserve the canonical-main lifecycle semantics while making VM transport lossless and updating test sandboxes that are expected to remain ready.

Related Issue

No issue required: localized regression follow-up to #2726 and the failing main run https://github.com/NVIDIA/OpenShell/actions/runs/32423676399.

Changes

• Encode the VM main-process specification in a whitespace-free base64url envelope while continuing to decode legacy raw JSON.
• Add unit coverage for commands containing spaces across the VM guest environment boundary.
• Keep MCP, OIDC, and Kubernetes workspace test main processes alive instead of using commands that immediately terminate their sandboxes.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• cargo test -p openshell-core sandbox_env::tests -- --nocapture
• cargo test -p openshell-driver-vm build_guest_environment --lib -- --nocapture
• Kubernetes managed/operator and OIDC PKCE E2E test binaries compile with their required features
• bash -n e2e/mcp-conformance.sh
• mise run test in this worktree: all completed lanes passed, but the Rust lane hit the unrelated environment-sensitive gateway_completer_returns_empty_when_no_config test because a gateway is registered locally; clean CI will rerun it

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; no contract or intended behavior change)