fix: resolve compile warnings across workspace

- Remove duplicate Duration import and use unqualified Duration in ssh.rs
- Prefix unused default_image parameter with underscore in sandbox/mod.rs
- Make SecretResolver pub to match its use in pub function signature

Author: drew

crates/openshell-cli/src/ssh.rs

@@ -701,8 +701,8 @@ pub async fn sandbox_ssh_proxy(
     // exists but hasn't reached Ready phase yet. This is a transient state
     // after sandbox allocation — retry with backoff instead of failing
     // immediately.
-    const MAX_CONNECT_WAIT: std::time::Duration = std::time::Duration::from_secs(60);
-    const INITIAL_BACKOFF: std::time::Duration = std::time::Duration::from_secs(1);
+    const MAX_CONNECT_WAIT: Duration = Duration::from_secs(60);
+    const INITIAL_BACKOFF: Duration = Duration::from_secs(1);
 
     let start = std::time::Instant::now();
     let mut backoff = INITIAL_BACKOFF;
@@ -734,7 +734,7 @@ pub async fn sandbox_ssh_proxy(
                 "sandbox not yet ready (HTTP 412), retrying in {backoff:?}"
             );
             tokio::time::sleep(backoff).await;
-            backoff = (backoff * 2).min(std::time::Duration::from_secs(8));
+            backoff = (backoff * 2).min(Duration::from_secs(8));
             continue;
         }
         return Err(miette::miette!(

crates/openshell-sandbox/src/secrets.rs

@@ -6,7 +6,7 @@ use std::collections::HashMap;
 const PLACEHOLDER_PREFIX: &str = "openshell:resolve:env:";
 
 #[derive(Debug, Clone, Default)]
-pub(crate) struct SecretResolver {
+pub struct SecretResolver {
     by_placeholder: HashMap<String, String>,
 }
 

crates/openshell-server/src/sandbox/mod.rs

@@ -1011,7 +1011,7 @@ fn inject_pod_template(
     mut pod_template: serde_json::Value,
     template: &SandboxTemplate,
     gpu: bool,
-    default_image: &str,
+    _default_image: &str,
     image_pull_policy: &str,
     sandbox_id: &str,
     sandbox_name: &str,