feat(cli): add sandbox to projects capabilities enable

[posthog]

Problem

• The BYOC sandbox flow cannot be driven or tested end to end from the CLI while the team is actively building it — capability enablement is a hands-on, low-volume operation, so the only workaround is the dashboard or a raw PUT.
• alien projects capabilities enable sandbox dies at clap argument parsing: CapabilityName has Deployments, Ai, Encryption, Buckets, and Registry, but no Sandbox.
• The API side already exists — PUT /v1/projects/{idOrName}/project-capabilities/sandbox (configureProjectSandbox, added in 940b1fd) — and the generated client method has no caller. The CLI already knows the word sandbox via alien deploy --setup-item sandbox, so this is a pure parity gap.

Changes

• Add a Sandbox variant to CapabilityName and a match arm that calls configure_project_sandbox(), mirroring the Buckets arm.
• Add two flags on capabilities enable, both API-required:

Flag	Type	Validation
--image-bundle-uri	string	must be an s3:// URI (generated newtype try_from)
--max-session-lifetime-seconds	integer	must be within 1..=28800

• Fail fast when either flag is missing, and reject both flags for non-sandbox capabilities (matching the existing cross-capability guards).

Note

The generated maxSessionLifetimeSeconds type is NonZeroU64. typify short-circuits on minimum: 1 and drops the schema maximum, so the type enforces only the lower bound — the CLI validates the 1..=28800 range itself.

Testing

• cargo test was not run: no Rust toolchain is available in this environment.
• Added unit tests over the pure parser and validator: sandbox flags parse to the right variant; both range boundaries pass; missing URI, missing / zero / out-of-range lifetime fail; sandbox flags on another capability fail.

Agent context

• Type names were confirmed against the OpenAPI spec and typify 0.4.3 source (integer + string codegen), since the SDK is generated at build time and could not be compiled here.

---

Created with PostHog Desktop from this inbox report.