feat(sandbox-env): per-tenant pod resources for tenant warm pools

[pedrofrxncx]

Follow-up to #5830. A tenant whose repo needs more memory than the fleet default
had no way to ask for it: resources is a pod-spec field, so it can be neither
per-claim nor per-pool — it needs its own SandboxTemplate.

Shape

• The sandbox pod spec moves into a shared partial
  (sandbox-env.sandboxTemplateSpec). Setting tenantPools[].resources
  renders a second SandboxTemplate, named after the pool, from that same
  partial — so a hand-copied 400-line duplicate can't drift the first time
  someone edits one of them — and points the pool at it.
• Pools without resources keep sharing the chart-wide template. Their render
  is unchanged.
• The claim now names the template the pool's pods were actually built from,
  which Studio reads back off the operator's own SandboxWarmPool on each
  reconcile tick. Deliberately not a second string in
  STUDIO_SANDBOX_TENANT_POOLS: a claim naming a different template than the
  pod never binds, and we've already been bitten twice this week by two sides
  having to agree on one literal.

tenantPools:
  - name: tenant-acme-site-prod
    size: 2
    resources:
      requests: { cpu: "2", memory: "6Gi" }
      limits: { memory: "12Gi" }

Verification

The refactor is the risky part, so it was gated on a render diff. Rendering the
chart with prod-shaped values before and after, the only difference is the
helm.sh/chart label from the version bump:

34c34
<     helm.sh/chart: sandbox-env-0.12.1
---
>     helm.sh/chart: sandbox-env-0.13.0

Nothing else moves — the shared SandboxTemplate is byte-identical, so existing
installs that set no resources see no spec change and their pools don't roll.

Also verified: with two pools, one overriding resources and one not, the
overriding pool renders its own template with the overridden limits and points
at it, while the plain pool still points at studio-sandbox-<env>.

Not in this PR

• Per-tenant node placement (on-demand / do-not-disrupt). Same lever — it
  is now one $pool. reference away — but it wants its own values shape and a
  cost conversation.
• The updateStrategy: OnReplenish pin, which is feat(sandbox-env): per-tenant pod resources for tenant warm pools #5836's branch; this PR stays
  off those lines to avoid conflicting with it.

---

Summary by cubic

Enable per-tenant pod resources for tenant warm pools by rendering a dedicated SandboxTemplate when tenantPools[].resources is set. Pools without overrides keep using the shared template unchanged; claims now bind to the exact template the pool used.

• New Features
  • Helm: moved the sandbox pod spec into a shared partial (sandbox-env.sandboxTemplateSpec). Setting tenantPools[].resources renders a per-pool SandboxTemplate (named after the pool) and points the pool at it; others remain on the shared template (byte-identical render).
  • Studio/Operator: claims use the template the pool’s pods were built from. listWarmPoolPods() now returns { templateRef, pods }, and the runner caches per-pool template refs (falls back to the shared template before first reconcile).
  • Chart: bump to 0.13.0. values.yaml documents tenantPools[].resources.

^{Written for commit ce3aece. Summary will update on new commits.}