fix: return error instead of calling os.Exit in runInSandbox

Replace the direct os.Exit() call with a cli.StatusError return so
that all deferred cleanup functions (including stopTokenWriter) run
normally. The exit code is propagated via cli.StatusError and handled
in main.go.

This removes the need to manually call stopTokenWriter() before
os.Exit() and ensures all defers in the call chain execute.

Fixes #1981
Fixes #1986

Assisted-By: docker-agent

Author: dgageot

cmd/root/sandbox.go

@@ -8,6 +8,8 @@ import (
 	"os"
 	"os/exec"
 
+	"github.com/docker/cli/cli"
+
 	"github.com/spf13/cobra"
 
 	"github.com/docker/cagent/pkg/config"
@@ -64,10 +66,7 @@ func runInSandbox(cmd *cobra.Command, runConfig *config.RuntimeConfig, template
 
 	if err := dockerCmd.Run(); err != nil {
 		if exitErr, ok := errors.AsType[*exec.ExitError](err); ok {
-			// Clean up the token writer before exiting so the temp
-			// file is removed (defers won't run after os.Exit).
-			stopTokenWriter()
-			os.Exit(exitErr.ExitCode()) //nolint:gocritic // intentional exit to propagate sandbox exit code
+			return cli.StatusError{StatusCode: exitErr.ExitCode()}
 		}
 		return fmt.Errorf("docker sandbox exec failed: %w", err)
 	}

main.go

@@ -2,18 +2,23 @@ package main
 
 import (
 	"context"
+	"errors"
 	"os"
 	"os/signal"
 	"syscall"
 
 	"github.com/docker/cagent/cmd/root"
+	"github.com/docker/cli/cli"
 )
 
 func main() {
 	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 
 	if err := root.Execute(ctx, os.Stdin, os.Stdout, os.Stderr, os.Args[1:]...); err != nil {
 		cancel()
+		if statusErr, ok := errors.AsType[cli.StatusError](err); ok {
+			os.Exit(statusErr.StatusCode)
+		}
 		os.Exit(1)
 	} else {
 		cancel()