test(e2e): replace flaky Python live policy update tests with Rust

[johntmyers]

Summary

Replace two flaky Python e2e tests for live policy updates with Rust e2e tests that use the CLI's built-in --wait flag for reliable synchronization instead of manual 90s poll loops.

Related Issue

Fixes flaky E2E (python) job failure: https://github.com/NVIDIA/OpenShell/actions/runs/23920278132/job/69765280000?pr=740

Changes

• Removed from e2e/python/test_sandbox_policy.py:
  • test_live_policy_update_and_logs — flaked with "Policy v2 was not loaded within 90s" due to manual time.sleep(2) poll loop with hard 90s deadline
  • test_live_policy_update_from_empty_network_policies — same poll pattern, same flake risk
• Added e2e/rust/tests/live_policy_update.rs with two tests:
  • live_policy_update_round_trip — set policy A, verify version, re-push A (idempotent), push B (version bump via --wait), re-push B (idempotent), verify policy list history
  • live_policy_update_from_empty_network_policies — set empty network policy, push policy with rules, verify version bumps

Why Rust tests are more reliable

The Python tests polled GetSandboxPolicyStatus RPC every 2s with a 90s hard deadline. The Rust tests use openshell policy set --wait --timeout 120, which delegates synchronization to the CLI's own wait logic — eliminating the timing sensitivity.

Coverage notes

• Policy lifecycle (version, hash, idempotency, history): fully covered
• Proxy enforcement after update: covered by existing L4/L7/SSRF Python e2e tests
• GetSandboxLogs RPC: was tested in the old test but not replaced — known gap for follow-up

Testing

• cargo clippy passes on new test (no warnings)
• cargo check --features e2e passes for all Rust e2e tests
• mise run pre-commit (CI will verify)

Checklist

• Follows Conventional Commits
• Code follows the project's coding standards
• No secrets or credentials in the diff
• Changes scoped to the issue at hand