refactor(sandbox): cut echo mode's rebase conflict surface

[vessux]

Summary

Review artifact for an openlock-side fork change. Not intended to merge via this PR — fork main lands by rebase + force-push.

echo mode stays. It is the mechanism four CI-gated integration tests and policies/wire-proof-local.yaml use to prove cred_inject strip-and-replace on the wire, and there is no equivalent replacement: the --debug-egress logging is a hardcoded allowlist of one request header plus five response headers, and it never logs stripped headers at all — so a log-based assertion would pass unconditionally and couldn't catch a real strip regression. Generalising that logging isn't an option either; it would write injected credential values into an OCSF log that may be shipped off-box, which AGENTS.md forbids.

What echo did cost was rebase pain out of all proportion to the feature. Two changes fix that without touching behaviour.

Changes

1. l7/relay.rs — remove the else-wrapper entanglement. The echo branch wrapped the pre-existing forward body in } else {, indenting ~38 otherwise-unchanged lines by one level. git counts that as 38 deletions plus 38 re-insertions, which made this file one of the worst conflict hotspots against upstream. Replaced with an early continue — the branch already sits inside the loop { at line 650, and the forward path already treats fall-through as "continue loop" — so the forward body returns to upstream's exact indentation and drops out of the diff entirely.

git diff -w against the previous state is 3 insertions / 2 deletions: the change really is just the de-indent.

2. proxy.rs — merge the duplicate route query. query_l7_route_snapshot was called twice per connection, once early for the echo check and again later for L7 inspection. It is a pure function of (engine, decision, host, port), all fixed before either call, with no .await between them; its only side effect is an ocsf_emit! on the error path. Merged into one call, which also stops a double emission of that error event.

Impact

Fork delta against the merge base, across the affected files:

	insertions	deletions
before	830	62
after	793	24

Deletion churn — the part that actually collides on rebase, since it marks rewritten upstream lines rather than appends — drops 61%.

l7/rest.rs is byte-identical to before, so the echo JSON response contract (echo, method, path, query, headers, body_length, policy, cred_inject_applied) is untouched and needs no re-verification.

An intermediate approach that extracted a shared rewrite function plus a separate run_echo_relay orchestration loop was rejected: it reached 976/27, moving ~246 insertions into rest.rs (itself a top-5 hotspot, and where upstream's 40194f93 lands) and introducing a second lower-fidelity orchestration loop that could drift. The early-continue beats it on both axes for roughly one line.

Also includes a one-line MD022 fix for a pre-existing markdown lint failure in docs/sandboxes/manage-sandboxes.mdx that was blocking mise run pre-commit on a clean tree.

Testing

• cargo check and cargo clippy --workspace --all-targets --features openshell-prover/bundled-z3 — both exit 0
• 722 tests pass in openshell-supervisor-network, 83 in openshell-policy
• the 6 echo tests pass unchanged
• cargo fmt --check and mise run markdown:lint:md clean

mise run pre-commit's rust:check fails locally for an unrelated reason (the task omits --features bundled-z3 and this machine has no system libz3; it dies inside z3-sys's build script).