Resolve sandbox base digests without registry reads and force amd64 base builds

[ReganBell]

Fixes two verified incidents hit on real deployments (one Fly, one AWS).

1. sandbox publish --from <tag> fails with the mandated app-scoped Fly token

qm sandbox publish pinned a mutable --from base by running docker buildx imagetools inspect against the registry. Fly's registry rejects reads from app-scoped deploy tokens (only org tokens can read it), so publish failed exactly on the token the docs tell operators to use — while the build's own docker pull/push with that token works fine.

• Publish now resolves mutable base tags via docker pull --platform linux/amd64 + the recorded RepoDigests entry (new pinnedByPull), the same pull path the layer build already depends on. The pulled digest is the tag's top-level manifest/index digest — identical to what imagetools inspect returned — so recorded sandbox.baseImage pins are unchanged in form and remain pullable by machines. Publish no longer touches the registry read API at all.
• pinnedByDigest (inspect) remains only for fly rollback --to <tag>, where there is no build to piggyback on; its failure message now prints the exact workaround — pass the digest form <repository>@sha256:…, which skips the lookup entirely.

2. arm64 hosts build a base image the deploy rejects

Building the sandbox base on an Apple Silicon Mac defaulted to linux/arm64 (rejected at deploy time, since sandbox machines are amd64-only), and retrying with --platform linux/amd64 under qemu is slow and crashes in apt.

• scripts/local-sandbox-build.sh now targets linux/amd64 explicitly for both stages, and when FLY_SANDBOX_APP_NAME is set and flyctl is installed it builds on Fly's remote amd64 builder (flyctl deploy --build-only --push --remote-only --dockerfile fly/Dockerfile) and pulls the result instead of emulating locally. No new flags — better defaults only. (npm run deploy:fly-image already used the remote builder.)
• fly/README.md documents the amd64 requirement and the remote-builder behavior.

Tests

• New test: --from a Fly-registry tag pins by pull, never invokes imagetools inspect, flattens the layer Dockerfile onto the pinned ref, and records the pin.
• Updated the custom-Dockerfile re-resolution test and the pinnedByDigest workaround-message assertion; test docker fake now models pull and image inspect.
• Verified: cli/test/sandbox-publish.test.ts, sandbox-build, fly-sandbox, fly-up, package, root sandbox-base-image/local-sandbox tests all green; tsc --noEmit and eslint/oxlint clean.

An independent fresh-context review pass was run on the diff; its two findings (docker auth before the registry pull in the script, and a workaround message that also covers the custom-Dockerfile path) are addressed.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}