docs: remove deprecated --keep flag from tutorials and examples

[Ygnas]

Summary

Remove references to the deprecated --keep flag from tutorials and example
READMEs. The flag is hidden (hide = true), deprecated, and a no-op since
sandboxes are kept by default. Users following these docs were being taught
to use a flag that does nothing.

Related Issue

N/A — standalone docs correction. The --keep flag is declared deprecated
at crates/openshell-cli/src/main.rs:1247-1249 but tutorials and examples
still explained it as an active feature.

Changes

• Remove --keep from sandbox create commands in tutorials and examples
• Remove --keep explanation text that described it as a real feature
• Add --no-keep mentions where sandbox persistence is explained, so users
  know how to opt into auto-deletion
• Files changed:
  • docs/get-started/tutorials/first-network-policy.mdx
  • docs/get-started/tutorials/microsoft-graph-provider-refresh.mdx
  • examples/sandbox-policy-quickstart/README.md
  • examples/policy-advisor/README.md
  • examples/spiffe-token-grant-demo/README.md
  • scripts/agents/gator/README.md

Note for maintainers: Some scripts in the repository may still pass
--keep internally. Let me know if you would like those updated to rely on
the default keep behavior as well.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[Ygnas]

I have read the DCO document and I hereby sign the DCO.

[Ygnas]

recheck

[elezar]

Thanks @Ygnas. I think we can also remove the references to --keep in the internal scripts.