ateapi: Remove sandbox_class from Worker spec - #2922

Follow up after #2879

Removes sandbox_class from the Worker spec (ateapipb.Worker) and reads the worker's sandbox class from Worker.status.default_runtime.sandbox_class.

Each worker already reports its default_runtime (including sandbox_class) to WorkerService.RegisterWorker via atelet alongside its capacity before it can take any actors. Carrying sandbox_class on the Worker spec required ate-controller to copy it from the WorkerPool on CreateWorker and duplicated what the worker itself reports in WorkerStatus. Using status.default_runtime.sandbox_class as the single source of truth removes that duplication across ate-controller, ate-api-server, fake-workersync, and kubectl-ate.

Behavior changes

• Class is fixed by the first registration. RegisterWorker records the class from the first report and refuses a later report with a different default_runtime.sandbox_class (restorable runtimes must match it too). The pool's declared class no longer cross-checks the worker's report: the pod's shape comes from the pool, and the report is the pod's own authenticated statement. The proto comments on WorkerStatus.default_runtime and RegisterWorkerRequest.default_runtime document this.

• Before a worker registers it has no class. kubectl ate get/top workers show an empty CLASS for it and --sandbox-class filters it out;ate.workerpool.workers counts it under ate.sandbox.class=unknown (registry note updated). The scheduler never placed on such a worker, and still doesn't:Applies rejects an empty class, which also covers the "no default runtime" guard ateapi, atelet: remove sandbox_assets from Run and Restore RPCs #2879 added, so that guard is folded into the class check.

• Tests pass

• Appropriate changes to documentation are included in the PR