fix(providers): honor configured profile sources in sandboxes

[drew]

🏗️ build-from-issue-agent

Summary

Make sandbox creation and provider attachment validate provider environment keys against the gateway's configured provider profile catalog. This prevents disabled builtin profiles from colliding with same-ID user profiles when provider_profile_sources selects only user profiles.

Related Issue

Closes#2877

Changes

• Snapshot the workspace-scoped configured provider profile catalog during sandbox creation and provider attachment.
• Pass that catalog to provider environment-key uniqueness validation instead of constructing the builtin-plus-user default catalog.
• Keep the default-catalog validation wrapper test-only so production callers cannot bypass the configured source set.
• Add regression coverage for create and attach using a user-only catalog containing a user-managed github profile.

Deviations from Plan

None.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable; no sandbox infrastructure or policy runtime change)

Tests added:

• create_sandbox_uses_configured_provider_profile_sources
• attach_sandbox_provider_uses_configured_provider_profile_sources

Additional verification:

• Focused regression tests fail before the production fix with the reported duplicate github profile error and pass after the fix.
• All openshell-server sandbox handler tests pass (64 passed, 1 ignored).
• Full mise run test passes when OPENSHELL_SYSTEM_GATEWAY_DIR points to an empty test registry.
• mise run ci passed all Rust, TypeScript, formatting, lint, and generated-artifact checks. Its Go test task is environment-blocked because three existing SDK gateway-list tests read the real /etc/openshell/gateways/default entry and expect no system gateways; this PR does not change Go code.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; the implementation now matches the existing gateway configuration docs)