bug(cli): stop uploads when Git filtering fails or selects no files #3847

User Story

As an OpenShell user uploading files to a sandbox, I want the default .gitignore filtering to be respected, so that only the files I intended to upload are transferred.

Problem Statement

Uploads use Git to apply filtering by default, but currently fall back to uploading the selected path without filtering when:

• The Git check fails, for example because Git is unavailable. The filtering error is discarded and the upload proceeds without a warning about the fallback.
• Filtering succeeds but selects no files. The CLI prints a warning and proceeds with an unfiltered upload.

This affects both sandbox upload and sandbox create --upload. The CLI already has --no-git-ignore for explicitly requesting an unfiltered upload.

This came up during Codex-assisted review of PR #3795, where Git needed to be added to the Snap package definition for the upload conformance tests to pass. Packaging Git addresses that particular trigger, but leaves the fallback behavior in place.

Impact / Why This Matters

The CLI can transfer ignored local files that the user did not intend to include. A warning after filtering selects nothing does not give the user a chance to stop that upload.

Users can work around this by staging only the intended files in a separate directory. That requires manual checking and copying despite filtering being enabled by default. Installing Git avoids the missing-executable case but does not cover other Git failures or an empty filtered selection.

Acceptance Criteria

• When filtering is enabled and Git filtering fails, the affected upload stops before transferring files and reports the reason.
• When filtering selects no files, the affected upload stops without falling back to an unfiltered transfer.
• Diagnostics explain that --no-git-ignore can be used for an intentional unfiltered upload.
• The behavior is consistent for sandbox upload and sandbox create --upload.
• Explicit --no-git-ignore continues to allow unfiltered uploads.
• Regression coverage includes unavailable/failing Git, an empty filtered selection, a normal filtered upload, and the explicit override. Behavior outside a Git repository is defined explicitly.
• Relevant CLI documentation reflects the resulting behavior.

Reproduction Steps

Proposed reproduction with dummy files and a disposable sandbox; not run end-to-end during issue preparation:

1. Initialize a temporary Git repository, add runs/ to .gitignore, and create runs/marker.txt containing dummy text.
2. Run openshell sandbox upload <sandbox> <repo>/runs <destination> without --no-git-ignore.
3. Observe the warning that filtering excluded all files, followed by an unfiltered upload of the selected directory.
4. Separately, run an upload of the repository with Git unavailable to the CLI process, while keeping other upload prerequisites available. The current planner silently selects an unfiltered upload.
5. Check the equivalent behavior using sandbox create --upload.

Expected: stop on filtering failure or an empty selection; require --no-git-ignore for an intentional unfiltered retry.

Environment

• Product: OpenShell CLI.
• Source inspected: 9f60f55c6b0811b1651099b50e4618d435ebc02e.
• Discovery context: Snap packaging and Ubuntu VM conformance work in PR test(tmachine): build and test local Snap packages #3795.
• Original binary version and exact OS version: not recorded in the report.

Code References

Static inspection confirms the fallback in crates/openshell-cli/src/run.rs:

• sandbox_upload_plan() discards errors from git_sync_files() through an if let Ok(...) condition and falls through to Regular.
• Both callers handle GitFilteredEmpty by warning and calling the unfiltered sandbox_sync_up().
• sandbox_upload_plan_falls_back_when_all_files_gitignored currently tests the empty-selection fallback and will need updating.