Start sandbox creation before the image pull / checkpoint download completes

ateom doesn't hear anything until all of atelet's prep is done, so sentry startup is serialized after the image pull (cold start) or the checkpoint download (restore).

- Restore: download and bundle prep run concurrently, but [g.Wait()](https://github.com/agent-substrate/substrate/blob/89b83a5c89db8b189401645a645b01c144b7d728/cmd/atelet/main.go#L1090) gates the `RestoreWorkload` RPC on both.
- Cold start: `prepareOCIBundles` completes before `RunWorkload` is sent

Nothing about the sandbox itself depends on the actor image or the checkpoint. The sandbox could be booting while those are still downloading.

## Proposal

Split sandbox creation out of `RunWorkload` / `RestoreWorkload` into its own RPC that atelet can send as soon as the sandbox-level config is ready, then have the existing RPC start the containers.

It helps cold start and DATA-scope restore. Does not help FULL / DATA_ON_GOLDEN restore, where the sentry comes from the memory image.