feat: support read-only root filesystem for sandboxes

[GodBlf]

Summary

Fixes #1549.

• Add the readOnlyRootFilesystem lifecycle API field with tri-state request handling and runtime-derived responses.
• Implement read-only root filesystem support for Docker and Kubernetes template workloads, including writable runtime storage, gate-based Docker injection, volume protection, and final-state validation.
• Reject unsupported Windows and Pool request combinations without overriding existing template or operator security policies.
• Regenerate and align Python, JavaScript, Kotlin, Go, and C# SDK models and Sandbox creation options.
• Add server, SDK, runtime, and documentation coverage.

Validation

• Server pytest: 1499 passed
• Kubernetes provider tests: 186 passed
• Kubernetes mini E2E: 16 passed, 6 skipped
• Kubernetes operator make test: passed
• Python, JavaScript, Kotlin, Go, and C# SDK tests and generation checks: passed
• Docker and Kubernetes read-only root filesystem runtime validation: passed
• Documentation build: passed

The repository-wide Python Docker E2E script could not reach its test phase because the local cached Go image is 1.24 while the current execd modules require Go 1.25, after a transient Docker registry metadata failure.