fix(sdk): protect API key in direct data-plane mode

[ruirui6946]

Summary

• prevent the JavaScript and C# SDKs from forwarding OPEN-SANDBOX-API-KEY to execd and egress in direct mode
• retain tenant authentication for lifecycle requests and server-proxied data-plane requests
• remove the tenant key from the C# shared HttpClient defaults so raw and streaming data-plane calls cannot inherit it

Closes #1689

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Commands run:

• corepack pnpm exec eslint src scripts --max-warnings 0
• corepack pnpm exec tsc -p tsconfig.json --noEmit
• corepack pnpm exec tsup
• node --test tests/*.test.mjs (107 passed)
• dotnet test OpenSandbox.sln --no-restore (181 passed)

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (not needed; request behavior now matches the documented proxy declaration)
• Added/updated tests
• Security impact considered
• Backward compatibility considered

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1fded56f83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".