Move sandbox pool inventory and scaling behind RPC

Implement safe pool inventory and set-desired RPC servers and migrate cli/commands/sandbox_pool_list.go and sandbox_pool_set_desired.go to those APIs, removing their raw entity operations without a fallback. Inventory needs pool IDs/short IDs, version, app/service, scaling mode, desired/current/ready counts and timestamps without SandboxSpec/environment disclosure. Resolve runtime config and addon bindings server-side only. Scaling must preserve absolute/relative adjustments, nonnegative validation, no-op behavior and optimistic concurrency. AppStatus.AppInfo provides active-version pool summaries, not full all-version pool inventory or scaling. Coordinate schema changes with sandbox management; own pool methods/DTOs only.

Follow-up to MIR-2084 (audit thread). Scope: implement operation-specific RPC schemas, server handlers, registration, authorization policy and contract/regression tests. This batch includes server implementations and migration of sandbox-pool list and sandbox-pool set-desired to SandboxPools without an EntityAccess fallback. Preserve CLI flags, validation and human-readable output; JSON must use safe summaries rather than execution specs/resolved environments. Sandbox lifecycle and app exec selection remain owned by MIR-2086. Pushing and PR creation are not requested. Keep this issue In Progress until merged. Reuse existing APIs and authorization patterns; do not expose arbitrary entities, execution specs or resolved credentials. Verify app ownership on every app-scoped operation and preserve cluster-admin/runner boundaries. Coordinate overlapping schema/generated/registration files at integration. Run focused tests and required lint before committing.

Acceptance: public handlers and the migrated pool CLI commands implement the listed behavior without giving callers EntityAccess; test allowed and denied/cross-app cases plus the area's meaningful edge cases. Existing behavior remains unchanged outside the pool RPC and CLI migration; safe pool JSON replaces the raw execution-spec-bearing shape.