chore: remove deprecated --keep flag from docs, scripts, and e2e tests (#2126)

* docs: remove deprecated --keep flag from tutorials and examples

The --keep flag is deprecated, hidden, and a no-op since sandboxes
are kept by default. Remove references from tutorial docs and example
READMEs that explain it as a real feature.

- Remove --keep from sandbox create commands
- Remove --keep explanation text
- Clarify that sandboxes are kept by default

Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com>

* chore: remove deprecated --keep usage from scripts and e2e tests

The --keep flag is a deprecated no-op since sandboxes are kept by
default. Stop passing it in internal scripts, e2e test scripts,
and example demo scripts.

Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com>

---------

Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com>

scripts/agents/gator/README.md

@@ -42,8 +42,6 @@ The launcher:
 - For `--harness codex`, optionally bakes a host Codex executable as `/etc/openshell/agent-payload/runtime/harnesses/codex/codex`.
 - Starts the selected harness without a TTY.
 - Runs gator in `watch` mode by default. The sandbox stays alive while the supervisor sleeps between bounded Codex cycles, so Codex is not connected during passive PR waits. The supervisor prints periodic heartbeat lines during active cycles and passive sleeps.
-- Deletes the sandbox automatically after the supervisor exits. Pass `--keep` to preserve it for debugging.
-
 The GitHub provider profile allows read-only GraphQL queries on `api.github.com/graphql` so `gh` read paths can use GraphQL when needed. Write operations remain REST-only and scoped to the two allowed repositories.
 
 Set `GATOR_CODEX_ACCESS_CREDENTIAL_KEY` or pass `--codex-access-key` if the gator Codex profile uses a credential key other than `CODEX_AUTH_ACCESS_TOKEN` for the short-lived access token.

scripts/smoke-test-network-policy.sh

@@ -131,14 +131,14 @@ write_policy() {
     echo "$file"
 }
 
-# Create a sandbox with --keep and a sleep, wait for Ready.
+# Create a sandbox with a sleep, wait for Ready (sandboxes are kept by default).
 create_sandbox() {
     local name="$1"
     shift
     local provider_flag=("$@")
 
     echo "  Creating sandbox: $name"
-    openshell sandbox create --name "$name" --keep "${provider_flag[@]}" \
+    openshell sandbox create --name "$name" "${provider_flag[@]}" \
         -- sh -c "echo Ready && sleep 3600" >/dev/null 2>&1 &
     local pid=$!
 
@@ -147,7 +147,7 @@ create_sandbox() {
         if openshell sandbox list 2>/dev/null | grep -q "$name.*Ready"; then
             echo "  Sandbox $name is Ready"
             SANDBOXES+=("$name")
-            # Kill the blocking create process (sandbox stays alive with --keep)
+            # Kill the blocking create process (sandbox stays alive by default)
             kill "$pid" 2>/dev/null || true
             wait "$pid" 2>/dev/null || true
             # Brief settle time — SSH server inside the sandbox may still be