fix(sandbox): fix create ordering race, dual-registry credentials, and policy identity clearing

[drew]

Summary

Follow-up fixes for #170 (CloudFront CDN registry switch) that were discovered during testing but never committed.

• Fix create_sandbox store-before-k8s race: Write the sandbox record to the store before creating the Kubernetes resource. Previously the sandbox watcher could race and write a fallback record with spec: None, causing the supervisor to fail with "sandbox has no spec". Error cleanup paths now use early returns and clean up store + index on failure.
• Dual-registry credential forwarding: When the component image registry differs from the distribution registry (e.g. local dev registry vs CloudFront CDN), pass DIST_REGISTRY_* env vars to the cluster container and add a second mirror + auth block in registries.yaml so containerd can pull community sandbox images at runtime.
• Fix policy identity clearing for custom images: Use get_or_insert_with to ensure a policy always exists before clearing process identity. Previously, if no explicit policy was passed with a custom image, clear_process_identity was skipped, causing the server to fall back to disk discovery which could re-introduce run_as_user: sandbox for images without that user.
• Wire up store reconciler: spawn_store_reconciler was implemented in feat(cli): switch community sandbox registry to CloudFront CDN #170 but never actually spawned in server startup.