feat: Add psc_endpoint parameter to Sandboxes.send_command and Sandboxes.generate_browser_ws_headers so VPC-SC sandboxes with ingressControlConfig.enablePrivateServiceConnect=true (which populate only connection_info.service_attachment, never load_balancer_hostname / load_balancer_ip) can route data-plane traffic through a customer-provisioned PSC endpoint. Existing non-VPC-SC callers are unaffected; the parameter defaults to None and the load-balancer branches remain the primary path. - #7146