feat: support durable Template creation from Linux ECS images

## Summary

Add a generic, DB-backed Template creation flow. A Template is identified by `template_id`; once ready, sandbox creation resolves `fiber_pool_id` from that record. The initial source type is a Linux ECS shared image.

## Required flow

1. Validate and copy the shared ECS image into a custom image.
2. Export the custom image as QCOW2 into a private, same-account OSS bucket.
3. Submit an isolated sandbox task that builds and publishes the OCI init-container image from the QCOW2 object.
4. Call the Fiber pool creation seam (placeholder adapter until the external method is available).
5. Mark the Template ready with its `artifact_uri` and `fiber_pool_id`.

## Persistence

Use one generic `template` record keyed by `template_id`, with `template_type`, `spec`, `status`, `current_step`, `artifact_uri`, `fiber_pool_id`, `execution_context`, error fields, and timestamps. ECS/OSS/OCI transient identifiers belong in `execution_context`; the OSS bucket is configuration. Do not persist signed URLs.

## Execution model

Use a low-frequency, restart-safe reconciler that periodically scans `PENDING`/`CREATING` templates and advances one step. Confirmed failures become `FAILED`; do not automatically retry failed steps. Polling an already submitted remote task is status reconciliation, not a business retry.

## Acceptance criteria

- Creating a Template returns/persists its `template_id`.
- The reconciler advances persisted steps and resumes after process restart.
- Sandbox creation resolves `fiber_pool_id` only from a `READY` Template.
- Provider-specific fields do not become first-class Template columns.
- Existing sandbox behavior remains unchanged.

Start by locating the existing Template persistence, sandbox creation flow, and any task or reconciliation entry points. Trace how a template_id can persist each creation step and how sandbox creation currently obtains its fiber pool. Done means restart-safe advancement to READY or FAILED, with artifact_uri and fiber_pool_id available only for a READY Template while existing sandbox behavior remains unchanged.

Written by the indexing model from the issue text.