variable: promote variables out of sandbox into a top-level command

[hbrooks]

Summary

• agent sandbox variable ... becomes agent variable .... The sandbox parent command is gone; it held nothing else.
• Hidden aliases unchanged: variables, var, env, plus ls/rm on the leaves.
• variable replaces sandbox in the Platform group of TOP_LEVEL_GROUPS, so it does not fall through to "Other".
• README and the ellipsis skill updated to the new spelling.
• src/commands/sandbox.ts and its test renamed to variable.ts. No logic changes.

Variables are an account-wide store, not a property of a sandbox, so the extra level was pure typing. This matches the dashboard, where variables is now its own page rather than a tab under Sandboxes.

No redirect from the old path, matching the frontend call: variables are pre-customer.

The three REST routes are untouched (GET and PUT on /v1/sandboxes/variables, DELETE /v1/sandboxes/variables/{name}). The CLI now says variable while the API still says sandboxes/variables. Worth a follow-up in the mono repo if we want them to agree.

Test plan

• npm run typecheck
• npm test (375 pass)
• agent --help shows variable under Platform
• agent variable list returns the real table
• Hidden aliases resolve: agent variables ls, agent var set
• Leaf --help still prints the API route lines
• Note for the reviewer: a removed top-level command silently becomes a session prompt via the session start --connect shorthand. So agent sandbox ... now starts a session instead of erroring.