refactor(cli): group global actions - #2988

## Summary
Move sandbox-scoped workflow action modules into
`src/lib/actions/sandbox/**` so command adapters and sandbox workflow
orchestration have separate, visible layers.

## Stack Navigation
- Position: 57 of 60
- Previous PR: [#2986 — test(cli): enforce initial layer import
boundaries](#2986)
- Next PR: [#2988 — refactor(cli): group global
actions](#2988)

## Changes
- Moved sandbox
connect/destroy/rebuild/status/logs/doctor/gateway-state/process-recovery/skill/snapshot
actions under `src/lib/actions/sandbox/`.
- Moved sandbox policy/channel action helpers under
`src/lib/actions/sandbox/policy-channel.ts`.
- Updated command adapters, runtime dispatch facade, tests, and
remaining callers to the new paths.
- Kept behavior unchanged; this PR is a structural move plus import
updates.

## Type of Change
- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
- [x] `npx prek run --all-files --stage pre-push` passes
- [x] `npm run build:cli`
- [x] `npm run typecheck:cli`
- [x] `npx tsx scripts/check-layer-import-boundaries.ts`
- [x] Sandbox command adapter targeted tests pass
- [x] No secrets, API keys, or credentials committed
- [ ] Docs updated for user-facing behavior changes
- [ ] `make docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the style guide (doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Enhanced sandbox cleanup during destruction to properly unload Ollama
models, terminate proxy processes, and stop host services for complete
resource cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

## Summary
Move registry, config, path, gateway, session, and sandbox persistence
modules into `src/lib/state/**` so persistence boundaries are visible in
paths.

## Stack Navigation
- Position: 59 of 60
- Previous PR: [#2988 — refactor(cli): group global
actions](#2988)
- Next PR: [#2991 — refactor(cli): group docker
adapters](#2991)

## Changes
- Moved registry/config/path/gateway/session/sandbox state modules under
`src/lib/state/`.
- Moved co-located state tests and updated dist/source paths in
integration tests.
- Updated action, command, onboarding, policy, service, and test imports
to the new state paths.
- Updated CodeRabbit path instructions and migrated-path guard canonical
paths for moved state modules.
- Kept behavior unchanged; this PR is a structural move plus import
updates.

## Type of Change
- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
- [x] `npx prek run --all-files --stage pre-push` passes
- [x] `npm run build:cli`
- [x] `npm run typecheck:cli`
- [x] `npx tsx scripts/check-layer-import-boundaries.ts`
- [x] State and registry targeted tests pass
- [x] No secrets, API keys, or credentials committed
- [ ] Docs updated for user-facing behavior changes
- [ ] `make docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the style guide (doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Reorganized internal state management modules into a dedicated
directory structure to improve code organization and maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>