Automate compatible Docker Sandboxes prebuilt promotion

[joecklau]

Summary

• make Docker Sandboxes runtime admission depend on the stable v1 runtime contract and template schema instead of exact source-recipe identity
• preserve signed provenance while adding compatible hosted-promotion records and automatic candidate reevaluation
• gate Act and Full publication on fresh upstream workflow evidence and keep force-candidate runs alias-free
• narrow recipe identity to actual prebuilt artifact inputs and document the resulting GHCR lifecycle

Validation

• focused Go tests and race tests passed
• workflow contract and both platform asset/prebuilt validators passed
• built-in GitHub Actions token API probe passed
• Act no-alias live run passed and skipped stale upstream publication
• Full no-alias live run passed both platform builds, hosted smoke checks, attestations, signing, and candidate publication
• act-latest, full-latest, and catalog-v1 digests were unchanged after the probes