feat: Standardize on TOGETHER_* environment variables and default machine config

[christianalfoni]

Standardize on TOGETHER_* environment variables

Drop the legacy CSB_* aliases everywhere and read only TOGETHER_* env vars across the SDKs, CLI, e2e tests, and CI workflow.

❌ Current behavior

SDK + CLI  →  read TOGETHER_API_KEY, fall back to CSB_API_KEY
SDK        →  read CSB_BASE_URL for management API override
e2e tests  →  read CSB_API_KEY, CSB_SNAPSHOT_ID, CSB_BASE_URL
GH workflow→  pass secrets.CSB_API_KEY + CSB_SNAPSHOT_ID to test jobs
docs       →  document CSB_* in 3 README/CLAUDE files

✅ New behavior

SDK + CLI  →  read TOGETHER_API_KEY only (no CSB_ fallback)
SDK        →  read TOGETHER_BASE_URL
e2e tests  →  read TOGETHER_API_KEY, TOGETHER_SNAPSHOT_ID, TOGETHER_BASE_URL
GH workflow→  pass secrets.TOGETHER_API_KEY + TOGETHER_SNAPSHOT_ID
docs       →  TOGETHER_* documented uniformly; CSB_* removed

Repo-wide grep CSB_ now returns zero matches.

🤔 Assumptions

• secrets.TOGETHER_API_KEY will be added to the GitHub repo's Actions secrets before this PR is merged — the e2e workflow will fail with an empty key otherwise.
• CODESANDBOX_SENTRY_ENABLED was previously documented but unreferenced in code; dropped from docs rather than renamed.

🧠 Decisions

• Hard cut, no deprecation window. SDKs no longer accept CSB_API_KEY as a fallback — callers using it will hit the "TOGETHER_API_KEY env var must be set" error. Acceptable because there is no public release using CSB_* yet.
• CSB_SNAPSHOT_ID → TOGETHER_SNAPSHOT_ID (kept the prefix for symmetry rather than dropping it to bare SNAPSHOT_ID).
• CLI CLAUDE.md trimmed: deleted a stale file-layout diagram and a whole "API client conventions" section that referenced files that don't exist (utils/constants.ts, utils/api.ts). The CLI uses TogetherSandbox from the SDK directly now, so the conventions section was misleading.
• Removed broken together-sandbox-cli/src/utils/api.ts — it imported getInferredBaseUrl from ./constants.js (file does not exist) and was unused by any command. Pure dead code.

🔄 Discussions

• Mid-session a merge of CSB-1419 brought in a new tests/e2e/ directory and .github/workflows/e2e.yml that referenced CSB_* everywhere. Plan was extended to migrate those too rather than leaving the workflow broken.
• The Python e2e tests imported CreateSandboxParams from together_sandbox — but that symbol isn't exported. Switched the tests to plain kwargs (sdk.sandboxes.create(snapshot_id=...)) which also fits the Python SDK's actual API.

🧪 Testing

• Repo-wide grep CSB_ and grep CODESANDBOX return zero matches.
• Merge conflicts in CLAUDE.md, together-sandbox-python/README.md, and tests/e2e/test_snapshots.py resolved manually.

📁 References

• together-sandbox-typescript/src/configuration.ts
• together-sandbox-typescript/src/TogetherSandbox.ts
• together-sandbox-python/together_sandbox/_configuration.py
• together-sandbox-python/tests/e2e/helpers.py
• together-sandbox-python/tests/e2e/test_snapshots.py
• together-sandbox-python/tests/e2e/test_sandbox_lifecycle.py
• together-sandbox-python/pyproject.toml
• together-sandbox-python/README.md
• .github/workflows/e2e.yml
• CLAUDE.md
• together-sandbox-cli/CLAUDE.md

---

Make sandbox resource allocation optional with sensible defaults

Calling sdk.sandboxes.create() no longer requires the caller to specify millicpu, memory_bytes, and disk_bytes. Common cases collapse from a 5-line config object to a one-liner.

❌ Current behavior

// TS — every call had to spell out the same boilerplate
const sandboxModel = await sdk.sandboxes.create({
  snapshotAlias: "my-app@v1",
  millicpu: 1000,
  memoryBytes: 512 * 1024 * 1024,
  diskBytes: 10 * 1024 * 1024 * 1024,
});

# Python — same problem
sandbox_model = await sdk.sandboxes.create(
    snapshot_alias="my-app@v1",
    millicpu=1000,
    memory_bytes=512 * 1024 * 1024,
    disk_bytes=10 * 1024 * 1024 * 1024,
)

✅ New behavior

// TS — defaults to 1 vCPU / 2 GiB memory / 10 GiB disk
const sandboxModel = await sdk.sandboxes.create({
  snapshotAlias: "my-app@v1",
});

// Override individual values when needed:
await sdk.sandboxes.create({
  snapshotAlias: "my-app@v1",
  memoryBytes: 4 * 1024 * 1024 * 1024,  // 4 GiB
});

# Python
sandbox_model = await sdk.sandboxes.create(snapshot_alias="my-app@v1")

# Override individual values when needed:
await sdk.sandboxes.create(
    snapshot_alias="my-app@v1",
    memory_bytes=4 * 1024 ** 3,  # 4 GiB
)

🤔 Assumptions

• The defaults match what the SDK's own Snapshots.ts memory-snapshot path was already hardcoding (cpuCount=1, memoryMb=2048, storageMb=10240). That was the de-facto sizing for "create a sandbox without thinking about it."
• 1000 millicpu satisfies the API constraint (≥ 250, multiple of 250).

🧠 Decisions

• Client-side defaults, not OpenAPI changes. The API spec still marks the three fields required on the wire; the SDK fills them in before serializing. Keeps the contract unchanged and lets us iterate on defaults without regenerating clients.
• ?? not || in TS so a caller who explicitly passes 0 reaches the API (and gets the proper validation error) instead of being silently rewritten.
• TS constants exported, Python constants module-private. Sandboxes.ts exports DEFAULT_MILLICPU / DEFAULT_MEMORY_BYTES / DEFAULT_DISK_BYTES because Snapshots.ts reuses them directly (it calls the generated api.createSandbox, bypassing the facade). Python has no equivalent cross-module use, so the constants stay internal.
• Python create() keeps its kwarg-only signature (* separator preserved) — only the defaults changed.
• Snapshots.ts memory-snapshot block kept its explicit body but now imports the constants instead of declaring local cpuCount/memoryMb/storageMb variables. Smaller diff than restructuring the namespace dependency graph.

🧪 Testing

• Type-checked locally (TS tsc --noEmit, Python signature change is mechanical).
• Unit test for the defaulting behavior is not yet written — pending step 10 of the breakdown (together-sandbox-python/tests/test_facade.py). Recommend adding a test that verifies sandboxes.create(snapshot_id=...) with no resource args calls the underlying client with millicpu=1000, memory_bytes=2 GiB, disk_bytes=10 GiB.
• Docs were the carrier for several pre-existing bugs that got fixed as a side effect:
  • TS doc tables used snake_case field names (snapshot_id, memory_bytes) — corrected to camelCase to match the actual SDK surface.
  • CLI docs imported CreateSandboxBody from a generated-client internal module — replaced with the public kwarg form.

📁 References

• together-sandbox-typescript/src/Sandboxes.ts
• together-sandbox-typescript/src/types.ts
• together-sandbox-typescript/src/Snapshots.ts
• together-sandbox-python/together_sandbox/_sandboxes.py
• docs/typescript-sdk.md
• docs/python-sdk.md
• docs/cli.md