Make sandbox crashes visible in logs and metrics #2212

Sub-issue of #2211. #2211 needs core changes to move a dead actor to CRASHED. This one covers the o11y fixes we can do now, so at least there is something to look at when a sandbox dies.

Today we get almost nothing. In my kind tests (sentry kill, OOM kill, app kill), the only trace was one unlabeled atunnel WARN after a request failed. When a runtime operation fails, the error just says exit status 128.

1. Flag dead sandboxes in the stats sweep. ateom-gvisor already reads the actor cgroup every minute (cmd/ateom-gvisor/internal/cgroupstats). Also read oom_kill from memory.events and check whether the cgroup still has any processes. If either changes, log a WARN with actor labels and bump a counter. After my OOM test the cgroup still showed oom_kill 3 with no processes left, so the data is there.
2. Put the runsc stderr tail in the error. Right now runsc.go returns only the exit status. With the last ~2 KB of stderr, the crash message would say cannot checkpoint container "_pause" in state stopped instead of exit status 128.
3. Label runsc logs with the actor. Pause-container runsc lines have no actor labels. App-container runsc lines show up in kubectl ate logs as if the app wrote them.
4. Keep sentry panics. Pass --panic-log and log it with actor labels when it isn't empty. Today nothing is kept (see gVisor sandbox dies on restore for python:3.12-slim workloads (arm64) #1769).
5. Better crash event. Add the crash message to ate.actor.crashed. When ateom restarts, add the kubelet reason and exit code to the message. On kind, a node OOM only showed up as "ateom restarted while hosting the actor".
6. Small ones. In atelet, log stats sweep failures as WARN instead of DEBUG (cmd/atelet/statspoller.go:276). For microVM, log the tail of console.log when something fails, before cleanup deletes it.

Out of scope here: changing actor state, and reason labels on the metric. Both belong in #2211.