feat(pagination): stabilize list cursors and clean vm warnings

[gmenher]

References:

• Issue: feat(api)!: standardize list RPCs on opaque page tokens #3047
• Parent issue: Stabilize public API, SDK, and extension contracts for 0.1.0 #2565

Summary

This PR stabilizes the public list pagination contract for the API, SDK, CLI, and TUI surfaces that participate in issue #3047.

The main goal is to replace offset-driven list behavior with opaque continuation tokens where the contract requires stable pagination, while keeping the changes consistent across the server handlers, SDK wrappers, CLI output, and coverage.

What changed

• Added opaque continuation tokens for the relevant list endpoints and made the server-side pagination contract stable across inserts and deletes.
• Propagated page-token support through the SDK and CLI layers so the new contract is available to callers end to end.
• Tightened the CLI list output so collection listings preserve the token envelope instead of dropping continuation state.
• Added and adjusted tests to cover the new pagination behavior, the SDK round-trips, and the regression cases found while validating the branch locally.
• Cleaned up CI-related issues uncovered while integrating the pagination slices, including the VM build script warnings and vendored dependency handling.

Design notes

• The implementation keeps the pagination cursor opaque to callers so the listing contract can remain stable even when the underlying collection changes.
• Cursor generation uses the resolved record identity instead of ad hoc request fields, which keeps encode/decode aligned and avoids mismatches between empty and resolved workspace names.
• The server keeps the fallback offset-based paths only where they are still needed for non-cursor flows, but the token-based contract is used for the stable global listings that matter here.
• The additional CI fixes are intentionally scoped to make the branch shippable without introducing unrelated surface-area changes.
• The external API contract in this PR is intentionally decoupled from the internal persistence-layer audit tracked in refactor(persistence): audit pagination and add record iteration helpers #2802. Once that work lands, the server handlers here may benefit from migrating to the shared iteration helpers to replace the current manual offset loops.

Testing / Validation

• mise run ci
• cargo test -p openshell-server list_workspaces_returns_stable_page_tokens_for_global_list --features test-support
• CLI smoke validation with IPv6 gateway endpoint, including openshell status, policy pagination, and TUI launch
• Manual validation of workspace / sandbox pagination behavior after adding and deleting records

Checklist

• architecture docs updated (if needed)
• DCO sign-off
• Conventional Commits followed

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.