Before this fix, CreateContainer would proceed even if the sandbox
had already stopped or was in an unknown state. This could result in
containers being created in an unusable sandbox, leading to confusing
errors downstream.

StartContainer already guards with the same check:

  if sandbox.Status.Get().State != sandboxstore.StateReady {
      return nil, fmt.Errorf("sandbox container %q is not running", ...)
  }

Apply the identical guard in CreateContainer, immediately after the
sandbox state is known, so that callers receive a clear error instead
of a partial container object.

Fixes containerd#13599

Signed-off-by: crawfordxx <[email protected]>