Add declarative sandbox image builds

[cdreetz]

Summary

• Add declarative Image definitions for sandbox runtime images
• Add SandboxClient.build_image(...) / async equivalent to build or reuse an image and return a registry reference
• Document the build-once, create-many sandbox flow
• Add focused tests for Dockerfile rendering, image build/upload/polling, reuse, and batch fanout

Testing

• uv run ruff check packages/prime-sandboxes/src/prime_sandboxes/images.py packages/prime-sandboxes/src/prime_sandboxes/sandbox.py packages/prime-sandboxes/src/prime_sandboxes/__init__.py packages/prime/src/prime_cli/__init__.py packages/prime-sandboxes/tests/test_declarative_images.py
• uv run pytest packages/prime-sandboxes/tests/test_declarative_images.py packages/prime-sandboxes/tests/test_models.py packages/prime-sandboxes/tests/test_client_retry.py packages/prime/tests/test_sandbox_cli.py

Notes

• Live smoke tested building a declarative image, creating a sandbox from the resulting registry ref, then deleting the sandbox and test image.