fix(sandbox): make staging smoke fail on stream errors

[drewstone]

Summary

• let staging smoke use TANGLE_API_KEY directly, matching company secret setup
• default to the staging-proven router model zai/glm-4.7
• fail if the sandbox stream emits an error, ends without a terminal event, or misses the expected git diff text

Verification

• node --check scripts/staging-worker-smoke.mjs
• git diff --check
• pnpm run lint
• dotenvx run -q -o -f ~/company/devops/secrets/agent-state.env -fk ~/company/devops/secrets/.env.keys -- bash -lc 'node scripts/staging-worker-smoke.mjs'\n\nLive staging proof: created sandbox-a180ce273733, saw expected +provider-git-from-staging diff, saw result + done, no error event, deleted sandbox.

[tangletools]

✅ Auto-approved PR — 860c583e

Blanket team auto-approval is enabled for this reviewer service.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-06-26T21:54:30Z}