ateapi, atelet: remove sandbox_assets from Run and Restore RPCs - #2879

Follow up after agent-substrate#2879 

Removes `sandbox_class` from the `Worker` spec (`ateapipb.Worker`) and
reads the worker's sandbox class from
`Worker.status.default_runtime.sandbox_class`.

Each worker already reports its `default_runtime` (including
`sandbox_class`) to `WorkerService.RegisterWorker` via `atelet`
alongside its capacity before it can take any actors. Carrying
`sandbox_class` on the `Worker` spec required `ate-controller` to copy
it from the `WorkerPool` on `CreateWorker` and duplicated what the
worker itself reports in `WorkerStatus`. Using
`status.default_runtime.sandbox_class` as the single source of truth
removes that duplication across `ate-controller`, `ate-api-server`,
`fake-workersync`, and `kubectl-ate`.


#### Behavior changes

- **Class is fixed by the first registration.** `RegisterWorker` records
the class from the first report and refuses a later report with a
different `default_runtime.sandbox_class` (restorable runtimes must
match it too). The pool's declared class no longer cross-checks the
worker's report: the pod's shape comes from the pool, and the report is
the pod's own authenticated statement. The proto comments on
`WorkerStatus.default_runtime` and
`RegisterWorkerRequest.default_runtime` document this.
- **Before a worker registers it has no class.** `kubectl ate get/top
workers` show an empty CLASS for it and `--sandbox-class` filters it
out;`ate.workerpool.workers` counts it under `ate.sandbox.class=unknown`
(registry note updated). The scheduler never placed on such a worker,
and still doesn't:`Applies` rejects an empty class, which also covers
the "no default runtime" guard agent-substrate#2879 added, so that guard is folded into
the class check.


- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR