test(sdk): staging integration passes — full lifecycle on remote K8s

Verified against arpi-staging.eastus2.cloudapp.azure.com:
- Sandbox create/poll/running on real K8s cluster
- Execd via server proxy (use_server_proxy=true)
- SSE streaming: 5 NDJSON events captured (init, ping, stdout x2, complete)
- File info, metrics, delete all working
- WithAuthHeader(X-API-Key) for proxied deployments

Author: AlexandrePh

sdks/sandbox/go/opensandbox/staging_test.go

@@ -94,8 +94,9 @@ func TestStaging_FullLifecycle(t *testing.T) {
 	}
 	t.Logf("Sandbox is Running: %s", running.ID)
 
-	// 4. Get execd endpoint
-	endpoint, err := client.GetEndpoint(ctx, sb.ID, 44772, nil)
+	// 4. Get execd endpoint (use server proxy — pod IPs aren't reachable externally)
+	useProxy := true
+	endpoint, err := client.GetEndpoint(ctx, sb.ID, 44772, &useProxy)
 	if err != nil {
 		t.Fatalf("GetEndpoint(44772): %v", err)
 	}
@@ -108,14 +109,15 @@ func TestStaging_FullLifecycle(t *testing.T) {
 	}
 	t.Logf("Normalized execd URL: %s", execdURL)
 
-	// 5. Execd ping
-	execToken := ""
+	// 5. Execd ping — proxy requires same API key as lifecycle
+	execToken := apiKey
 	if endpoint.Headers != nil {
 		if v, ok := endpoint.Headers["X-EXECD-ACCESS-TOKEN"]; ok {
 			execToken = v
 		}
 	}
-	execClient := opensandbox.NewExecdClient(execdURL, execToken)
+	execClient := opensandbox.NewExecdClient(execdURL, execToken,
+		opensandbox.WithAuthHeader("X-API-Key"))
 
 	if err := execClient.Ping(ctx); err != nil {
 		t.Fatalf("Execd Ping: %v", err)
@@ -157,7 +159,7 @@ func TestStaging_FullLifecycle(t *testing.T) {
 	t.Logf("Metrics: cpu_count=%.0f mem_total=%.0fMiB", metrics.CPUCount, metrics.MemTotalMB)
 
 	// 9. Egress (may not be available)
-	egressEndpoint, err := client.GetEndpoint(ctx, sb.ID, 18080, nil)
+	egressEndpoint, err := client.GetEndpoint(ctx, sb.ID, 18080, &useProxy)
 	if err != nil {
 		t.Logf("GetEndpoint(egress/18080): %v (skipping egress tests)", err)
 	} else {