fix: map Daytona sandbox secret sync HTTP 4xx failures to 422

[thesujai]

Summary

Closes #

Changes

How was this tested?

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, python/trueforge_sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Low Risk
Narrow change to HTTP status mapping and API documentation for sandbox secret sync errors; no auth or persistence changes.

Overview
Sandbox environment PUT and DELETE secret sync failures from Daytona that return HTTP 4xx are now surfaced as 422 instead of 502, so clients can distinguish provider-side rejection from upstream/gateway failures.

sandboxEnvironmentSecretHttpError still maps Daytona authorization problems to 422 via getDaytonaAuthorizationErrorMessage, and additionally checks whether error.cause is a DaytonaError with a 4xx statusCode before falling back to 502. OpenAPI/route descriptions for 422 on create/update and delete were expanded to mention the provider rejecting the secret or deletion.

^{Reviewed by Cursor Bugbot for commit 9087056. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 9087056

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR