## Why
The TUI's Windows sandbox turn-context override was ignored by `thread/settings/update`, and onboarding derived sandbox state from local configuration instead of the app server's effective configuration.
## What changed
- Read Windows sandbox configuration from the app server before showing the onboarding sandbox creation hint. Show the hint only when the read succeeds and the sandbox is disabled.
- Remove `windows_sandbox_level` from `AppCommand::OverrideTurnContext` and stop sending sandbox-only overrides after setup or feature changes.
- Rely on the effective configuration refresh after setup instead of updating local sandbox flags manually.
## Testing
Update the trust-directory rendering test and snapshot to cover the sandbox creation hint.
GitOrigin-RevId: 2ee6b0634812e7b39fd73dab3ae344729910ba70
ca99b271d4