fix(deploy-sandbox skill): use non-destructive uv pip install for openshell extras

[maxdubrinsky]

Root cause

Pre-flight step 3 and the "If verification fails" recovery table of the deploy-sandbox skill told users to install the openshell extra with:

uv sync --package nemo-deployments-plugin --extra openshell

uv sync --package narrows the workspace venv to that one package's dependency set. It uninstalls nmp, nemo_agents_plugin, and python_on_whales from the venv, so nemo services run then fails with No module named 'nmp.platform_runner'. The step's own precondition check (import python_on_whales, openshell) reports DEPS_MISSING both before and after, because the first remedy removes exactly what the second (uv pip install -e 'plugins/nemo-agents[container]') reinstalls.

Fix

Replace both occurrences of the destructive command with the additive form:

uv pip install "openshell>=0.0.92" "grpcio>=1.78.0" "protobuf>=6.31.1"
uv pip install -e 'plugins/nemo-agents[container]'

uv pip install adds the two missing pieces into the existing workspace venv without narrowing it, so the platform stays intact. The surrounding prose now spells out why uv sync --package is wrong here.

Adversarial verification

Run in an isolated worktree venv, proving the new command is non-destructive:

1. uv sync --frozen --all-packages -> baseline platform venv.
2. Platform imports: python -c 'import nmp.platform_runner' -> platform ok; nemo services --help loads its CLI group cleanly.
3. DEPS_MISSING precondition: .venv/bin/python -c 'import python_on_whales, openshell' -> ModuleNotFoundError: No module named 'python_on_whales' (DEPS_MISSING), matching the skill's own check.
4. Ran the NEW commands verbatim -> installed openshell==0.0.97 and python-on-whales==0.81.0.
5. Re-verified: import python_on_whales, openshell -> DEPS_OK AND import nmp.platform_runner -> platform ok AND nemo services --help still loads.

Step 5 is the proof: the new commands add the extras while leaving the platform importable. The old uv sync --package command was not run against this venv on purpose (it would break the platform, which is the whole bug); the platform-still-imports evidence is the critical half.

Fixes AIRCORE-980
https://linear.app/nvidia/issue/AIRCORE-980

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	30409/38435	79.1%	63.8%
Integration Tests	18009/37104	48.5%	21.0%