fix: quote sandbox name in openshell policy commands

[ericksoa]

Summary

Fixes #46 — onboarding fails at step [7/7] with unexpected argument 'mkdir' when applying policy presets.

The sandbox name was interpolated unquoted into shell commands:

// Before (broken)
run(`openshell policy set --policy "${tmpFile}" --wait ${sandboxName}`);
run(`openshell policy get --full ${sandboxName} 2>/dev/null`);

// After (fixed)
run(`openshell policy set --policy "${tmpFile}" --wait "${sandboxName}"`);
run(`openshell policy get --full "${sandboxName}" 2>/dev/null`);

On DGX Spark, prior sudo usage pollutes openshell's shell context, causing stray tokens like mkdir to leak into the argument list.

Changes

• Extract buildPolicySetCommand() and buildPolicyGetCommand() helpers that properly quote all arguments
• Add 4 tests verifying quoting behavior
• All 42 tests pass

Test plan

• Run npm test — all 42 tests pass
• Run full onboard on DGX Spark and verify step [7/7] completes
• Verify nemoclaw <name> policy-add works with preset application

🤖 Generated with Claude Code

[dnandakumar-nv]

Nice fix.

One pre-existing bug worth fixing here while we're touching this file: currentPolicy is declared const on line 94 but reassigned on line 136:

  const currentPolicy = parseCurrentPolicy(rawPolicy);            
  // ...                                                                                                                                               
  if (!currentPolicy.includes("version:")) {                      
    currentPolicy = "version: 1\n" + currentPolicy; // TypeError: Assignment to constant variable                                                      
  }                                                                                                                                                    

This will throw at runtime if a sandbox has an existing policy with no version: field. Simple fix is changing const to let on line 94.