fix(cua-sandbox): provision Fleet sandboxes with SDK builders

[r33drichards]

What changed

• migrate cua-sandbox Fleet record construction to the generated builder API
• re-export Fleet builders while preserving legacy record exports
• upgrade cua-fleet to 0.1.7 and align distribution/packaging contracts
• add a scope-aware regression test preventing direct builder-enabled constructors

Verification

• 59 focused sandbox/Fleet tests passed
• Ruff passed on all edited Python files
• PDM lock/build smoke passed
• clean PyPI-only install resolved cua-fleet==0.1.7 and exposed CreatePoolRequestBuilder
• final whole-branch review reported no findings

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[r33drichards]

E2E rerun completed on candidate 9ea5b31ff0be07b0cb150ec62ed53ee94a4e0eab with published cua-fleet==0.1.8.

Empty namespace: pr2979-e2e-1786222159

Observed live ordering:

• GET /api/namespaces/{name} -> 404
• POST /api/namespaces -> 201
• POST .../osgymsandboxtemplates -> 201
• POST .../osgymsandboxwarmpools -> 201

The pool then hit the bounded 120-second guest readiness timeout, which is outside the namespace-ordering P1. Rollback succeeded: Kubernetes namespace lookup returned NotFound, SDK lookup returned 404, the temporary scoped ukey-* was revoked (204), and all temporary credential files/keyring data were removed.

Final focused verification: 70 passed; Ruff, Black, isort, packaging/distribution checks, and PR CI pass.