Exercise Azure Sandboxes ACR pull identity in polyglot fixtures

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the work

`AzureSandboxesExtensions.WithAcrPullIdentity` was added in #19008 and marked `[AspireExport]`, but the checked TypeScript fixture does not invoke it. This method is particularly important for polyglot callers because it is required when targeting an existing sandbox group: the supplied UAMI must already be attached to that group and authorized with `AcrPull` on the configured registry.

The current fixture at:

```text
tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sandboxes/TypeScript/apphost.mts
```

exercises workload identity through `withUserAssignedIdentity`, but not the distinct image-pull identity API.

Checked `api/*.ats.txt` files are release compatibility baselines and should not be manually regenerated merely for an additive PR API. The important follow-up is generated-SDK/runtime fixture coverage; the release baseline workflow can capture the accepted API at the normal time.

### Expected outcome

Update the Sandbox polyglot fixture to:

- create a dedicated Azure user-assigned identity for ACR image pulls,
- call `withAcrPullIdentity(...)`, separately from workload identity configuration,
- restore/generate the TypeScript SDK and type-check the AppHost,
- inspect the generated declaration/signature and JSDoc,
- and, if practical, exercise capability dispatch so this is more than compile-only coverage.

Keep pull and workload identities distinct in the fixture to reinforce the least-privilege API contract.

### Suggested validation

```bash
aspire restore --project tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sandboxes/TypeScript/aspire.config.json
# Then run the repository's normal TypeScript type-check for this fixture.
```

Also cover analyzer/capability ID stability and verify no generated member collision with other compute integrations' `withAcrPullIdentity` methods.

### Additional context

Follow-up from #19008 and Copilot review discussion `discussion_r3885375932`. The hosting package is experimental and expected to receive follow-up PRs.

Start with tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sandboxes/TypeScript/apphost.mts and restore it using the supplied aspire.config.json command. Keep the ACR pull identity separate from withUserAssignedIdentity, then run the fixture's normal TypeScript type-check and inspect the generated declaration, signature, and JSDoc. Done means the fixture covers withAcrPullIdentity without generated member collisions, with capability dispatch covered if practical.

Written by the indexing model from the issue text.