atelet, ateapi: report worker runtimes per sandbox class - #3022

Replace WorkerStatus.default_runtime and restorable_runtimes with
sandbox_classes, a list of WorkerSandboxClass keyed by sandbox_class. Each
entry carries that class's default_runtime and restorable_runtimes as
WorkerSandboxRuntime, a runtime the worker runs with its compatibility
version. RegisterWorkerRequest and the internal
ateletpb.RegisterWorkerRequest take the same list. ActorSandboxRuntime
stays as the stamp on assignments and snapshots.

Two flat fields can only ever describe versions of one sandbox class, while
WorkerPoolSpec.sandboxClasses is already a list. Turning default_runtime
into a repeated field after GA would be a breaking change; doing it now,
while stored-data breaks are still allowed, is cheap. A worker-side runtime
is its own message so that what a runtime can also restore, and its name,
can be added to it later without re-typing the lists or reaching an actor's
stamp. The lists allow one entry, matching WorkerPoolSpec.

This is a stored-data break: Worker rows are binary protos, so existing
installs need a fresh database. Callers move to the new shape in the two
commits that follow; the tree builds again at the last of them.

…lass

The node file atelet writes for a worker pod lists sandboxClasses, one entry
per class the pool declares, with that class's defaultRuntime and
restorableRuntimes, each a runtime with its version, as the registration
request has them; the flat layout is no longer read. buildFile emits one
entry for the pool's class, and the written-versions bookkeeping and write
log go through the list.

ateom registers the entry for the class it implements, its SandboxClass,
and waits when the file has no such entry or no default for it, as it did
for a missing default. atelet forwards sandbox_classes to the control
plane field for field instead of converting one default and a list of
restorables.

internal/hardware looks up the worker's entry for the snapshot's class. It
matches the snapshot's compat against that entry's default_runtime, then
its restorable_runtimes in order, and builds the ActorSandboxRuntime stamp
from the match. RuntimeFor falls back to ColdBootRuntime, the default of
the worker's class. SandboxClass is that class alone, for the readers that
need nothing else: the scheduler, which skips a worker that has registered
no class yet, the worker metrics, and kubectl ate's worker filter and
CLASS column.

WorkerService.RegisterWorker checks each entry's sandbox_class against the
class the Worker's first registration recorded and stores the list as
reported. fake-workersync reports one entry for the pool's class.

Fixtures build the worker side from the same ActorSandboxRuntime a test
expects on the stamp, so both sides of a match derive from one value.