refactor(cli): remove local Dockerfile builds from sandbox --from #3098

User Story

As an OpenShell CLI user, I want sandbox create --from to behave consistently across compute drivers and local or remote gateways, so that the command does not depend on an implicit local Docker-only build path.

Problem Statement

openshell sandbox create --from currently treats a local Dockerfile path, or a directory containing a Dockerfile, as a request to build an image with the caller's local Docker daemon. This behavior only works with a local Docker-backed gateway and makes the meaning of --from depend on the selected driver and gateway location.

This contract should be removed before 0.1.0. --from should identify an existing sandbox or container image, not perform a local image build.

Impact / Why This Matters

The current convenience path creates a Docker-specific CLI contract that cannot work uniformly with Podman, Kubernetes, VM, MXC, or remote gateways. It also adds a hidden dependency on the caller's Docker daemon and makes scripts non-portable across gateway configurations.

Callers can build explicitly with docker build -t <image> ... and then pass that image tag to openshell sandbox create --from <image>. For non-local drivers, callers can push the image to a registry reachable by the driver. This workaround is explicit and sufficient, so retaining a second build workflow in the OpenShell CLI is unnecessary.

Proposed Design

Keep --from as the source selector for existing sandbox names and container image references. Remove detection and building of local Dockerfile paths and directories. When a value clearly refers to a local path, return an actionable error directing the caller to build and tag the image first, then pass the resulting image reference to --from.

Acceptance Criteria

• openshell sandbox create --from no longer invokes docker build or otherwise builds an image.
• Dockerfile paths and directories containing Dockerfiles are no longer accepted as sandbox sources.
• Local path input produces an actionable error showing the explicit build-then-create workflow.
• Existing sandbox names and container image references continue to work across supported drivers.
• Dockerfile source resolution, local build implementation, and their dedicated tests are removed.
• CLI help and published documentation no longer advertise Dockerfile or directory builds through --from.
• Migration notes identify this as a pre-0.1.0 breaking CLI change and show docker build -t <image> ... followed by openshell sandbox create --from <image>.

Alternatives Considered

Retain the local Docker convenience behavior. This preserves an existing shortcut but leaves --from driver-dependent and keeps a hidden local Docker requirement.

Generalize image builds across drivers or add a remote build service. That is a substantially larger product and security surface and is not justified when callers can use standard image-build tooling directly.

Parent Issue

• Stabilize public API, SDK, and extension contracts for 0.1.0 #2565