Sandbox stuck in unrecoverable Error phase after supervisor session drops (SSH disconnect); stop/start refuse to act

首先使用提供的网关日志和复现步骤，追踪报告的 sandbox stop 和 sandbox start 错误背后的 supervisor 会话处理和 sandbox 阶段验证。完成的标准是：SSH 连接断开后不再破坏恢复能力，或者通过明确的恢复路径恢复 sandbox，同时不丢弃 /sandbox。

Summary

When the SSH connection carrying a sandbox's supervisor session drops (e.g. client-side "Broken pipe"), the sandbox transitions to Phase: Error and there is no way to recover it short of sandbox delete + sandbox create. sandbox stop and sandbox start both refuse to act on an Error-phase sandbox, so the workspace inside /sandbox is unrecoverable.

Steps to reproduce

1. openshell sandbox create (image/policy running openclaw-start as main command)
2. Attach interactively over SSH and run through a long-running foreground process (e.g. an onboarding wizard)
3. Let the SSH client disconnect mid-session (e.g. network blip → client_loop: send disconnect: Broken pipe)
4. openshell sandbox get <name> → Phase: Error
5. openshell sandbox stop <name> → Error: sandbox must be Ready to stop (current phase: Error)
6. openshell sandbox start <name> → Error: sandbox must be Stopped to start (current phase: Error)

Relevant logs

[1789391074.213] [gateway] [WARN ] supervisor session: stream error
[1789391074.213] [gateway] [INFO ] supervisor session: ended

(log capture was truncated at time of report)

Expected

Either:

• The supervisor session should be independent of the client SSH connection that carries it (a network drop on the client side shouldn't kill the sandbox), or
• Error phase should have a documented recovery path (e.g. sandbox stop --force / sandbox recover) that doesn't discard the workspace.

Actual

The only path out of Error phase is sandbox delete, which discards the sandbox's workspace with no export/backup step offered.

openshell version: 0.0.116