feat(cli): add exec --stream for non-PTY bidirectional streaming exec

[dijdzv]

What

Adds a --stream flag to msb exec. It streams stdin/stdout bidirectionally
without buffering or a PTY, built on the existing streaming primitives
(Sandbox::exec_stream_with + ExecHandle::recv + ExecSink).

Diff is one file (crates/cli/lib/commands/exec.rs); the default exec path,
agentd, and the protocol are untouched.

Why

msb exec can't drive a long-lived guest process turn by turn (read turn N's
output, then send turn N+1's request):

• the default path reads stdin to EOF up front and buffers all output until
  the process exits (collect()), so output never comes back mid-run;
• -t/--tty allocates a PTY, which echoes input and translates CRLF —
  unsafe for line protocols like JSON lines.

--stream forwards host stdin incrementally and flushes guest stdout/stderr per
chunk, with no PTY. This lets a host driver run e.g. an agent CLI in stream-json
mode and read each turn before sending the next.

How

• New --stream bool; skips the upfront read_to_end of stdin.
• Calls exec_stream_with(... .stdin_pipe()).
• A background task forwards host stdin → guest stdin incrementally; host EOF
  closes the guest's stdin.
• Drains ExecEvents, writing + flushing Stdout/Stderr per chunk, exits with
  the child's code, and fails if the session ends without an Exited event
  (matching the buffered collect() path).

Notes

• Builds on the streaming SDK API already present (added in feat(microsandbox): add exec, attach, and streaming execution (#387) #387).

• Adds a CLI e2e test (crates/cli/tests/exec_stream.rs) that drives a guest
  turn by turn over the stream; it deadlocks under the buffered exec path, so
  it fails closed if streaming ever regresses. Gated behind #[msb_test] like
  the other KVM integration tests:

  cargo test -p microsandbox-cli --test exec_stream -- --ignored