feat(cli): add structured output to remaining list commands

[mrunalp]

User Story

As an operator or platform integrator automating OpenShell workflows, I want
every resource-listing command to support the same structured output formats,
so that I can consume typed data without parsing tables intended for humans.

Problem Statement

OpenShell has a shared -o/--output <table|json|yaml> convention for resource
lists such as sandbox list, provider list, gateway list, and workspace list. Four remaining literal list commands expose typed RPC data only as
fixed-width tables:

• openshell service list
• openshell policy list
• openshell sandbox provider list
• openshell workspace member list

Their empty states are also prose rather than parseable collections. Callers
must therefore parse column layouts, presentation strings, and abbreviated or
truncated values. This makes automation depend on formatting that is free to
change and gives closely related CLI commands inconsistent interfaces.

Impact / Why This Matters

Integrations that enumerate exposed services, policy revisions, attached
providers, or workspace members cannot use one stable CLI pattern. They must
call lower-level APIs or maintain command-specific table parsers. Table parsing
is especially lossy for policy list, which shortens policy hashes and load
errors for display.

The workaround increases maintenance cost and can silently return incorrect
data after harmless presentation changes. Direct API use also bypasses the
CLI's configured gateway, authentication, workspace selection, and error
handling, so it is not an equivalent replacement.

Proposed Design

Add -o/--output <table|json|yaml> to the four commands, defaulting to table
so existing interactive behavior remains unchanged.

JSON and YAML should emit collections whose records contain the data currently
represented by each table, using typed values and stable field names rather
than rendered columns. Structured policy history should preserve full values
instead of table abbreviations. Attached-provider output must remain
secret-free and expose metadata such as credential and configuration keys, not
their values.

Structured mode should emit an empty collection on stdout when no records
exist. It should never include ANSI styling or human-readable status messages.

This issue covers the four literal list commands only. Related read surfaces
such as service get, provider get, workspace get, provider refresh status, inference get, and rule get/history should be evaluated as
follow-up work after their output contracts are reviewed.

Acceptance Criteria

• service list, policy list, sandbox provider list, and workspace member list accept -o/--output <table|json|yaml>.
• JSON output is a parseable array on stdout and exits 0.
• YAML output represents the equivalent collection and exits 0.
• Structured records include at least the information shown by the current
  table, with typed values and without presentation-only truncation.
• Structured attached-provider output never exposes credential or
  configuration values.
• An empty structured result emits an empty collection on stdout with no
  human-readable empty-state message.
• Structured output contains no ANSI escape sequences.
• Default table output and empty-state behavior remain unchanged.
• --help and published CLI documentation describe the new output flag on
  each command.
• Tests cover both structured formats, empty collections, default table
  compatibility, and the public field mappings.

Alternatives Considered

Continue parsing tables. This keeps the CLI surface smaller but makes column
order, padding, status wording, and truncation part of an accidental automation
contract.

Add a command-specific --json boolean. settings get already has this older
pattern, but extending it would deepen inconsistency with the shared output
format used by resource lists and would omit YAML.

Add structured output to every read command in one change. Several non-list
commands are also candidates, but their schemas and whether they represent a
single object, collection, stream, or review document need separate decisions.
Keeping this issue to literal list commands makes the behavior and acceptance
criteria reviewable.

Agent Investigation

• SandboxProviderCommands::List, PolicyCommands::List,
  ServiceCommands::List, and WorkspaceMemberCommands::List have no output
  argument in crates/openshell-cli/src/main.rs.
• Their handlers in crates/openshell-cli/src/run.rs receive typed provider,
  policy revision, service endpoint, or workspace member messages and render
  tables directly.
• OutputFormat and the shared collection serializer already implement
  table, json, and yaml, including empty collections.
• No gateway API, policy semantics, or sandbox runtime behavior needs to
  change.

[mrunalp]

🏗️ build-plan

Implementation Plan

Issue type: feat
Complexity: Medium
Confidence: High — clear path

Summary

Add the shared table/JSON/YAML output convention to the four remaining literal
list commands. Preserve their current table and empty-state behavior while
giving structured modes stable, typed, command-specific schemas.

Scope

• crates/openshell-cli/src/main.rs: add and dispatch the output flag for all
  four commands and cover CLI parsing/help behavior.
• crates/openshell-cli/src/run.rs: add structured projections and serialize
  them before the existing table paths.
• crates/openshell-cli/tests/: update affected integration calls and add
  focused structured-output coverage where appropriate.
• docs/sandboxes/: document structured service, policy, attached-provider,
  and workspace-member listing.
• .agents/skills/openshell-cli/: keep the CLI workflow and reference aligned.

Implementation Steps

1. Add -o/--output <table|json|yaml> with a table default to each command
   and thread it into the run functions.
2. Add typed, secret-safe JSON projections for services, attached providers,
   policy revisions, and workspace members; use the shared collection printer
   before the existing empty/table branches.
3. Add parser and projection/serialization tests, including empty collections,
   full policy metadata, URL normalization, unknown roles/statuses, and secret
   exclusion.
4. Update published and agent-facing CLI documentation.
5. Run the full CLI test suite and mise run pre-commit.

Test Plan

• Unit tests: CLI defaults and accepted formats; exact public field mappings,
  types, normalization, deterministic key lists, unknown enum handling, and
  secret exclusion.
• Integration tests: Update existing mock-gateway calls for the new function
  arguments and exercise structured branches; use writer-level parse tests for
  JSON/YAML and empty collections without adding a large duplicate mock server.
• E2E tests: N/A — no gateway API, sandbox runtime, policy semantics, or
  deployment behavior changes.

Risks & Open Questions

• These schemas become public compatibility contracts. Keep them narrow and
  reuse existing policy status/hash naming where a contract already exists.
• Attached-provider output must expose key names only and must never serialize
  credential values, config values, or opaque credential handles.

Documentation Impact

Update the existing service, policy, providers-v2, and workspace-member pages,
plus the openshell-cli skill reference. No architecture, navigation, gateway
configuration, or compute-driver documentation changes are needed.

---

Revision 1 — initial plan