Implement Sandman portfolio improvements from Boring Infra plan

[sgr0691]

Summary

Implements the full Sandman improvement plan by adopting patterns from Campfire, Root, Harnie, Combie, and Meno across agent UX, infrastructure depth, portfolio integration, and distribution.

Agent UX

• sandman.cli.v1 machine contract — versioned JSON envelopes with schema + command fields, budget truncation helpers, and docs/MACHINE-CONTRACT.md
• Human-first flows — sandman (onboard), sandman up, sandman connect-agent --harness, sandman doctor --harness with readiness + nextAction
• Handoff packages — sandman handoff <name> --to <harness> writes Markdown continuation packages to ~/.sandman/handoffs/
• MCP server — sandman mcp serve exposes list/status/create/enable/connect/destroy tools with capability gating via ~/.sandman/mcp.toml

Infrastructure depth

• Environment templates — web-app, data-pipeline, ai-agent via sandman templates and create --template
• Provenance — createdBy, harness, session, goal fields on environment records
• Checkpoints / rollback — local state snapshots with sandman checkpoint and sandman rollback --last
• Provider shortcuts — init --use-aws-profile, --use-gcloud, --use-env
• Cloudflare + Vercel — promoted to supported; real KV/project provisioning and destroy cleanup

Portfolio integration

• Combie — sandman link <name> --combie writes link records for combie sync
• Meno-compatible verify — sandman verify <name> evaluates proven/disproven/unknown claims
• Loopback viewer — sandman view read-only dashboard (no secrets in browser)

Distribution & docs

• install.sh, docs/FIRST-RUN.md, docs/OPERATOR.md, docs/architecture.md
• sandman seed --reset deterministic fixture for evals/CI
• CLI version now reads from package.json (fixes 0.2.0 hardcode)
• Expanded evals/evals.json with handoff/MCP/template triggers

Test plan

• npm run build passes
• npm test — 121 tests passing
• New portfolio command tests (handoff, seed, checkpoint/rollback, verify, link, templates)
• Updated Cloudflare/Vercel adapter tests for real API provisioning