This addresses the "Known limitation" described in https://github.com/rwx-cloud/mint/pull/3616, where a forcibly-stopped sandbox command (i.e. running Ctrl+C or killing the pid locally) can leave the sandbox in a dirty state, making it impossible for the local environment to push a patch to it.

In this PR, the CLI starts from a defensive position and cleans the git state on the sandbox before applying its new patch.

Summary

• Adds a cleanSandboxState() step that runs after lock acquisition but before syncChangesToSandbox(), resetting the sandbox working tree with git checkout . && git clean -fd
• If a previous exec was interrupted (Ctrl+C, crash, network drop) between command execution and revertSandbox(), the next exec now self-heals instead of failing with a stale patch
• Only runs when sync is enabled (--no-sync skips it)

Test plan

• Unit test: cleanup commands run in correct order (after lock, before sync/exec)
• Unit test: cleanup is skipped when Sync: false
• Existing sync and lock tests pass with no regressions
• Manual: start a sandbox exec, Ctrl+C mid-execution, run another exec and verify it succeeds without manual reset