Summary

Fix standalone openshell sandbox upload so symlink sources, including dangling
symlinks, are preserved instead of being dereferenced or rejected during Git-aware
upload planning. This restores the intended behavior documented in the CLI reference.

Related Issue

Fixes #2309

Changes

• Route standalone sandbox uploads through the shared upload planning logic.
• Use symlink-aware metadata checks so dangling symlinks are accepted.
• Bypass Git filtering for symlink sources, allowing the archive layer to preserve the
  link.
• Add regression tests covering valid and dangling symlink uploads through the CLI
  command path.
• Document the symlink-preservation invariant in the upload function.

Testing

• mise run pre-commit passes
  • All relevant checks passed, but the workspace run encountered an unrelated
    environment-dependent failure in
    proxy::tests::test_forward_public_ip_allowed_without_allowed_ips because
    dns.google resolved to 198.18.1.240.
• Unit tests added/updated
• E2E tests added/updated (not applicable; CLI integration regression tests were
  added)

Additional commands run:

• mise exec -- cargo test -p openshell-cli
• mise exec -- cargo test -p openshell-cli --test sandbox_upload_integration
• mise exec -- cargo test -p openshell-cli symlink
• mise exec -- cargo check -p openshell-cli
• git diff --check

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; this restores already documented
  behavior)