hardware: report per-runtime CPU attributes at worker registration - #2345

…e#2381)

Fixes agent-substrate#2348 

Restoring a sandboxed actor from a checkpointed snapshot requires strict
compatibility between the worker that created the snapshot and the
worker restoring it — across the sandbox class (`gvisor`, `microvm`),
the host hardware (`architecture`, `cpu_features`), and the sandbox
runtime assets (`gvisor_asset_hash`, microVM kernel/rootfs digests).

- **Unified compatibility identity (`SandboxRuntime` &
`VersionedSandboxCompat`)**:
Combines `sandbox_class`, an informational version `name`, and a
`compat_version` (`schema_version` + `repeated AttributeEntry
attributes`) into a single self-contained message. When an actor is
checkpointed, the control plane can copy the worker's `default_runtime`
directly onto the snapshot, and during warm restore the scheduler can
match the snapshot's `SandboxRuntime` against candidate workers without
inspecting runtime-specific fields.
- **Zero-downtime runtime rollouts (`default_runtime` vs.
`restorable_runtimes`)**:
Workers report both a `default_runtime` (used for cold starts and new
checkpoints) and `restorable_runtimes` (other enabled runtime versions
on the worker that can still warm-restore existing snapshots while a new
default version rolls out).
- **Schema-versioned key-value attributes (`schema_version` +
`AttributeEntry`)**:
`compat_version.schema_version` (`"v1"`) versions the compatibility
attribute schema itself, while `attributes` uses a list-map of
`AttributeEntry` (`+k8s:listType=map`, `+k8s:listMapKey=key`) so
declarative validation enforces required keys, values, and length bounds
on every entry.
#### Scope of This PR vs. Follow-ups
- **In this PR**: Establishes the `SandboxRuntime` /
`VersionedSandboxCompat` proto schema and declarative validation,
updates `internal/hardware` (`ProbeHost` and `Matches`), and wires
end-to-end registration of `default_runtime` (with `sandbox_class` and
host architecture) and `restorable_runtimes` through `ateom`, `atelet`,
`ate-api-server`, and `fake-workersync`.
- **Follow-ups**:
- Enrich `default_runtime` (`name`, `gvisor_asset_hash`) and
`restorable_runtimes` from `SandboxConfig` once `SandboxConfig` moves to
`WorkerPool`.
- Probe CPU feature attributes (`cpu_features`) in
`hardware.ProbeHost()` (agent-substrate#2345 - WIP)
- Stamp `worker.status.default_runtime` onto snapshots at
pause/checkpoint time and filter candidate workers with
`hardware.Matches` during warm-restore scheduling.


- [ ] Tests pass
- [ ] Appropriate changes to documentation are included in the PR