fix(sandbox-tenki): address review feedback, update @tenkicloud/sandbox to ^0.5.4

[camcalaquian]

Addresses the bot review feedback on VoltAgent#1387 and bumps the SDK. Merging this into feat/sandbox-tenki updates the upstream PR directly.

Review feedback addressed

cubic P1 — abort/timeout during resume can wedge the lifecycle queue (sandbox.ts)
session.resume() is a unary RPC with no transport deadline, so a dead connection could hold lifecycleTransition (and every later stop()/start()/execute() on a paused sandbox) forever. Two-part fix:

• the resume RPC is now bounded by RESUME_TRANSITION_TIMEOUT_MS (180s, matching the SDK's waitResumed default); on expiry the sandbox stays paused and the queue drains. Retrying is safe — the engine treats resume on an already-RUNNING session as idempotent (verified in the engine source, resume_session.go).
• execute() passes its cancellation signal into resumeIfPaused, so a transition whose caller already timed out/aborted bails out at the head of the queue instead of issuing a resume RPC nobody is waiting for.

cubic P2 — mid-stream pump failure silently truncates output (sandbox.ts, utils.ts)
A pump that dies mid-read now flags its buffer as failed; resolveOutput then prefers the resolved run's complete aggregate bytes (still subject to maxOutputBytes truncation) over the silently-short streamed buffer.

cubic P3 — multiline reason injects extra stderr lines (utils.ts)
CR/LF in the guest agent's free-form reason are collapsed to spaces before composing the single-line diagnostic.

cubic P3 — docs omit TENKI_AUTH_TOKEN (website/docs/workspaces/sandbox.md)
Now mentions both fallback env vars, consistent with the README.

CodeRabbit — reject blank/multiline SSH keys (tools.ts)
publicKey schema now refines to non-empty, single-line entries before any provisioning/mutation, with schema tests.

CodeRabbit nitpicks — all four taken:

• createTenkiToolkit accepts a narrow exported TenkiToolkitSandbox (Pick<TenkiSandbox, "getSandbox" | "authorizeSshKey">); the test mock no longer needs as unknown as TenkiSandbox.
• vi.clearAllMocks() → vi.resetAllMocks() so per-test mock implementations don't leak across tests.
• Dropped the unused stdin/_writeSpy scaffolding from makeHandle.
• Added a language to the README's fenced diagnostic block (MD040).

SDK update

@tenkicloud/sandbox ^0.5.1 → ^0.5.4, lockfile regenerated with the repo-pinned pnpm@8.10.5 (--frozen-lockfile re-validated). The 0.5.4 pin of ws@8.21.1/@bufbuild/protobuf@2.12.1 re-keys a few dependent lockfile entries; no adapter API changes were needed.

Validation

• vitest run --coverage: 150 tests passed (was 133), coverage stays 100% lines/branches/functions/statements
• tsc --noEmit, tsup build, publint (pre-existing suggestions only), biome ci clean on changed files
• pnpm install --frozen-lockfile passes with pnpm 8.10.5