Sandbox-spec authority moves off a hardcoded list onto a runtime-api control plane

What this changes for operators

• PR #14849 (merge 56034afe10, merged to main 2026-06-16, NOT tagged) adds a DynamicRemoteSandboxSpecService that fetches available sandbox specs from the runtime-api GET /api/warm-runtime-configs endpoint rather than a hardcoded preset list — the foundation for custom and per-tenant execution images, with a companion guardrail refusing a custom image whose agent-server SDK version does not match.
• Operators planning custom or per-tenant execution images should track this; the sandbox is becoming a server-driven, configurable surface. It is on main, in no release.