Improve approval and sandbox flows

internal/telegram/render.go

@@ -443,6 +443,23 @@ func ParseApprovalCallbackData(data string) (int64, string, bool) {
 	}
 }
 
+func SandboxCallbackData(sandbox string) string {
+	return "sandbox:" + sandbox
+}
+
+func ParseSandboxCallbackData(data string) (string, bool) {
+	if !strings.HasPrefix(data, "sandbox:") {
+		return "", false
+	}
+	sandbox := strings.TrimPrefix(data, "sandbox:")
+	switch sandbox {
+	case "read-only", "workspace-write", "danger-full-access":
+		return sandbox, true
+	default:
+		return "", false
+	}
+}
+
 func WorkspaceCallbackData(id int64) string {
 	return fmt.Sprintf("workspace:%d", id)
 }