Vouch request: u0324020

[u0324020]

What do you want to work on?

1. A CLI fix: When openshell sandbox create fails to schedule a pod onto a node, a 300-second timeout only prints ConfigurationPending, while the gateway actually returns PodScheduled=Unschedulable and the scheduler message. The CLI should print the reason for the scheduling failure first.
2. An example provider profile in providers/ for Hermes Agent: A minimal-privilege provider profile for the Hermes Agent, whose header lists the four hosts it connects to on its own by default and the settings that disable them.

Why this change?

I'm running an agent sandbox on EKS using OpenShell 0.1.5/0.1.6. The first problem is one I encountered and reproduced twice on a shared cluster. The second one I worked out step by step while getting Hermes to run in a sandbox so that Hermes could run in the sandbox, hoping to save others the same amount of time.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md