Enable universal sandbox by provider ownership

[cwilhit]

Summary

• replace the unreleased sandbox policy variants with a binary off|on operator setting
• resolve App Studio and Infrastructure from the caller's exact workspace bindings using the existing enabled-providers API
• enable universal sandboxes only for platform/platform or same-organization self-hosted provider pairs; mixed ownership keeps the existing development-image path
• keep hosted/chart defaults off, set the App Studio self-host recipe to on, and require a single App Studio replica while sandbox claims use process-local CAS
• fail closed for missing, terminating, stale-claim, foreign-export, or incomplete binding state
• require organization-owned provider backends to use their registered edge route and return 503 instead of directly dialing tenant-controlled backend URLs

Operator behavior

App Studio	Infrastructure	mode=off	mode=on
platform	platform	development image	universal sandbox
same organization	same organization	development image	universal sandbox
platform	self-hosted	development image	development image
self-hosted	platform	development image	development image

The hosted Faros deployment remains off. App Studio's self-hosting recipe selects on, so an organization receives the universal sandbox only after it also binds its own Infrastructure provider.

Validation

• full App Studio Go tests and vet
• full Infrastructure Go tests and portal tests/build
• root tests, vet, lint, boilerplate, and focused hub provider tests
• Helm lint/render and binary policy chart tests
• focused backend-proxy race tests
• new-change App Studio lint: 0 issues
• live local kcp/hub binding matrix for hosted, future hosted opt-in, same-org BYO, and both hybrid directions
• live universal worker steel thread: provision, Ready, workspace seed/read, bounded Node exec, checkpoint, deletion, and runtime cleanup

All test-owned workspaces, bindings, Instances, and runtime resources were removed after validation.