fix(sandbox): apply initial OCSF JSON setting

[TaylorMutch]

Summary

Apply the effective ocsf_json_enabled setting during the sandbox poll loop initial settings fetch. This fixes OCSF JSONL export for sandboxes created after the global setting is already enabled.

Related Issue

Closes #1917

Changes

• Apply the OCSF JSONL toggle from the initial poll_settings() response.
• Reuse the same helper for initial and subsequent settings updates.
• Add regression tests for enabling from the initial settings snapshot and disabling when unset.

Testing

• mise run pre-commit passes
• cargo test -p openshell-sandbox
• cargo clippy -p openshell-sandbox --all-targets -- -D warnings
• mise run helm:skaffold:run
• Manual Kubernetes validation: created a sandbox with OCSF JSON disabled, confirmed JSONL stayed empty, enabled OCSF JSON, confirmed JSONL wrote records.
• Manual Kubernetes regression validation: created a sandbox while global ocsf_json_enabled=true, generated an OCSF event without any settings bump, and confirmed JSONL wrote records.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)