test(conformance): migrate sandbox template tests to template stories

e2e/rust/Cargo.toml

@@ -214,11 +214,6 @@ name = "workspace_lifecycle"
 path = "tests/workspace_lifecycle.rs"
 required-features = ["e2e"]
 
-[[test]]
-name = "sandbox_templates"
-path = "tests/sandbox_templates.rs"
-required-features = ["e2e"]
-
 [[test]]
 name = "proxy_egress_pipeline"
 path = "tests/proxy_egress_pipeline.rs"

e2e/suites/conformance/README.md

@@ -10,7 +10,8 @@ conformance area and user story. The CLI is the current client interface; lifecy
 - `cli/tests/<area>/<story>.rs`: test functions, steps, and assertions for a story.
 - `cli/tests/<area>/helpers.rs`: setup and assertions shared by that area's stories.
 
-The current areas are `file_transfer`, `lifecycle`, `policy_advisor`, and `smoke`.
+The current areas are `file_transfer`, `lifecycle`, `policy_advisor`, `sandbox_templates`,
+and `smoke`.
 Each area compiles into one test binary; individual stories remain selectable by
 their module prefix. `main.rs` contains only module declarations.
 
@@ -66,7 +67,8 @@ must supply the workload image and tools used by the selected scenarios. Missing
 CLI or gateway prerequisites fail the run rather than silently passing.
 
 Run one group with `--test file_transfer`, `--test lifecycle`,
-`--test policy_advisor`, or `--test smoke`, before the `--` separator. A group or
+`--test policy_advisor`, `--test sandbox_templates`, or `--test smoke`, before the
+`--` separator. A group or
 individual-test filter exercises only part of the suite.
 
 The tmachine conformance testsuite runs these same entry points from the

e2e/suites/conformance/cli/tests/sandbox_templates/duplicate_name.rs

@@ -0,0 +1,61 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+use super::helpers::{fails, finish, succeeds, template_json};
+use openshell_e2e_support::OpenShellRunner;
+
+/// Verify creating a template with an existing name is rejected and leaves the
+/// original definition unchanged.
+#[tokio::test]
+async fn sandbox_template_create_rejects_duplicate_name() {
+    let mut runner = OpenShellRunner::from_env("sandbox-templates/duplicate-name")
+        .expect("candidate openshell CLI is available");
+    let template = format!("ct-{}-dn", runner.id());
+    let result = async {
+        runner.check_gateway_status().await?;
+        let r = &runner;
+        let first = [
+            "sandbox",
+            "template",
+            "create",
+            &template,
+            "--label",
+            "e2e=first",
+        ];
+        succeeds(r, "create", "template is created", &first).await?;
+        let second = [
+            "sandbox",
+            "template",
+            "create",
+            &template,
+            "--label",
+            "e2e=second",
+        ];
+        fails(
+            r,
+            "duplicate",
+            "a second template with the same name is rejected",
+            &second,
+        )
+        .await?;
+
+        let json = template_json(r, "get", &template).await?;
+        if json["labels"]["e2e"].as_str() != Some("first") {
+            return Err(format!(
+                "duplicate create changed the template: {}",
+                json["labels"]
+            ));
+        }
+        succeeds(
+            r,
+            "delete",
+            "template is deleted",
+            &["sandbox", "template", "delete", &template],
+        )
+        .await
+    }
+    .await;
+    if let Err(error) = finish(runner, result, &[&template]).await {
+        panic!("sandbox-templates/duplicate-name conformance story failed:\n{error}");
+    }
+}