feat: upload TFY sandbox files without stuffing them onto exec argv

[bhaveshpatel640]

Closes #416

Summary

Upload TFY sandbox files as raw bytes instead of base64 on exec argv, so large files don't hit command-line limits.

Closes AGE-2266

Depends on : https://github.com/truefoundry/tfy-sandbox-server/pull/26

Changes

• Send uploads through the sandbox file-upload API instead of exec
• Abort hung uploads after 30 minutes (same default as Daytona uploadFile)
• Reject tenant-mismatched sandbox IDs before calling the server

How was this tested?

Unit tests in packages/trueforge-core/tests/core/sandbox/provider/tfyUpload.test.ts via pnpm test:trueforge-core

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, python/trueforge_sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Behavior change depends on the companion tfy-sandbox-server upload API; misconfiguration or server mismatch would break uploads, though tenant checks reduce cross-tenant risk.

Overview
TFY sandbox file uploads no longer pipe base64 through exec (echo … | base64 -d). TFYSandboxProvider.uploadFile now POSTs raw bytes to {serverUrl}/files/upload with sandbox_id and path query params, Content-Type: application/octet-stream, and a 30-minute client abort (aligned with Daytona’s default).

Uploads validate tenant ownership of the sandbox ID before any network call, and failures surface HTTP status text or the JSON { success: false, error } body. Unit tests in tfyUpload.test.ts cover the request shape, server errors, and tenant mismatch.

^{Reviewed by Cursor Bugbot for commit 4672161. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 4672161

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@truefoundry/trueforge-core	Patch
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1aa7f58. Configure here.}