fix(tui): preserve quoted post-create command arguments

[thotashashank302]

Summary

Preserve quoted arguments in the TUI Create Sandbox command field. /bin/sh -c "echo GOOD; read x" now reaches the shell as three arguments instead of splitting the script at each space. Invalid quoting leaves the form open with an error before sandbox creation is queued.

Related Issue

Closes #4113

Changes

• Parse the command once on form submission with shell-words, already present in the lockfile, and retain the argument vector through post-create execution.
• Escape each parsed argument individually at the SSH boundary so variables, substitutions, and operators remain literal unless the user explicitly invokes a shell.
• Add form regressions for quoting, escaping, empty arguments, empty commands, and malformed quotes; add Unix shell-execution tests for script input and literal argument preservation.
• Document the Command field behavior and update the TUI contributor guidance.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated
• E2E tests added/updated (live gateway/SSH interaction not exercised)

Verified on macOS arm64 with Rust 1.95.0:

• cargo fmt -p openshell-tui --check
• cargo test --locked -p openshell-tui: 91 passed
• cargo clippy --locked -p openshell-tui --all-targets -- -D warnings
• cargo test --locked -p openshell-cli --features openshell-server/prebuilt-z3: 640 passed, 2 integration tests and 4 doctests ignored. The prebuilt feature supplies Z3 because the system library is absent.
• Both new form regressions fail when whitespace splitting is temporarily restored and pass with the fix.
• target/debug/openshell term --help
• Documentation navigation check and pinned Markdown lint: passed
• Pinned Fern 5.112.0 validation: 0 errors, 3 warnings concerning an unrelated gateway configuration MDX page, unauthenticated redirect checking, and light-mode accent contrast
• git diff --check

The shell-execution tests use a local /bin/sh to verify the serialized remote command and stdin handling. A running sandbox, interactive TUI over SSH, Linux, and Windows have not been exercised. Upstream CI and maintainer review remain pending.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• User documentation and related TUI guidance updated
• Architecture docs updated (not applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @thotashashank302.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[thotashashank302]

I have read the DCO document and I hereby sign the DCO.