Make SandboxConfig spec immutable; mark defaults via annotation

[Zoe Zhao (zoez7)]

Models after StorageClass in kubernetes.

• the annotation sandboxconfig.ate.dev/is-default: "true" can be added or removed. If 2 configs of the same class are both annotated as default, the one created later will win.
• the spec field is immutable

apiVersion: ate.dev/v1alpha1
kind: SandboxConfig
metadata:
  name: gvisor-default
  annotations:
    sandboxconfig.ate.dev/is-default: "true"
spec:
  sandboxClass: gvisor
  pauseImage: ...
  assets:
    amd64:
      gvisor:
        url: "gs://gvisor/releases/nightly/2026-09-02/x86_64/gvisor.tar.zstd"
        sha256: "d547d81401461fd1c679c5c4fa0a6c2b8ef7dc3c22ce23c9e25dcc4c69cfd06f"
...     

• Tests pass
• Appropriate changes to documentation are included in the PR

K8s storage class reference: https://github.com/kubernetes/kubernetes/blob/36102b645d1a26a5945bd79173a16594c56b6aea/pkg/volume/util/storageclass.go#L60