Simplify the sbx CLI and curated-image workflow

[nueces]

Summary

• use positional VM names for lifecycle commands
• retain visible list/ls, remove/rm, and image list/image ls aliases
• make VM listing show all VMs by default, with --running filtering
• add deterministic JSON output for lifecycle, listing, and network status commands
• simplify network forwarding while retaining explicit --name selection
• keep security-sensitive behavior configuration-only
• update static shell completions for the revised command surface
• default curated images to the agent user through image-manifest metadata
• replace the exhaustive README with a guided curated-image workflow

Notable behavior changes

• lifecycle commands no longer accept --name; use positional NAME
• run --no-attach remains supported; --attach is removed
• sbx ls now includes stopped VMs
• network forward no longer guesses whether its first positional argument is a VM name
• curated images select run_user = "agent" unless CLI or configuration overrides it
• --project-path . remains explicit on first creation

Validation

• 207 tests passed
• 91.64% coverage
• Ruff passed
• git diff --check passed