fix: resolve compile warnings across workspace

- Remove duplicate Duration import and use unqualified Duration in ssh.rs
- Prefix unused default_image parameter with underscore in sandbox/mod.rs
- Make SecretResolver pub to match its use in pub function signature

Author: drew

crates/openshell-cli/src/ssh.rs

@@ -701,8 +701,8 @@ pub async fn sandbox_ssh_proxy(
     // exists but hasn't reached Ready phase yet. This is a transient state
     // after sandbox allocation — retry with backoff instead of failing
     // immediately.
-    const MAX_CONNECT_WAIT: std::time::Duration = std::time::Duration::from_secs(60);
-    const INITIAL_BACKOFF: std::time::Duration = std::time::Duration::from_secs(1);
+    const MAX_CONNECT_WAIT: Duration = Duration::from_secs(60);
+    const INITIAL_BACKOFF: Duration = Duration::from_secs(1);
 
     let start = std::time::Instant::now();
     let mut backoff = INITIAL_BACKOFF;
@@ -734,7 +734,7 @@ pub async fn sandbox_ssh_proxy(
                 "sandbox not yet ready (HTTP 412), retrying in {backoff:?}"
             );
             tokio::time::sleep(backoff).await;
-            backoff = (backoff * 2).min(std::time::Duration::from_secs(8));
+            backoff = (backoff * 2).min(Duration::from_secs(8));
             continue;
         }
         return Err(miette::miette!(

crates/openshell-sandbox/src/secrets.rs

@@ -62,7 +62,7 @@ pub(crate) struct RewriteTargetResult {
 // ---------------------------------------------------------------------------
 
 #[derive(Debug, Clone, Default)]
-pub(crate) struct SecretResolver {
+pub struct SecretResolver {
     by_placeholder: HashMap<String, String>,
 }
 

crates/openshell-server/src/sandbox/mod.rs

@@ -962,6 +962,7 @@ fn sandbox_template_to_k8s(
     result
 }
 
+
 fn container_resources(template: &SandboxTemplate, gpu: bool) -> Option<serde_json::Value> {
     let mut resources =
         struct_to_json(&template.resources).unwrap_or_else(|| serde_json::json!({}));