fix: allow runtime workloads to link live sandboxes

[alongubkin]

Summary

• allow runtime-provisioned Containers and Daemons to link an AWS Live Sandbox
• preserve the setup-time binding rejection for Workers and other setup-rendered consumers
• keep unsupported-platform lifecycle checks unchanged

Why

A Live Sandbox receives its image ARN and active version only after its runtime controller finishes. The compile-time check rejected every linked consumer on that basis, even though Container and Daemon controllers already wait for dependencies and resolve the completed binding from controller state.

Workers still render linked bindings during setup, so they continue to fail early with an explicit setup-time diagnostic.

Validation

• cargo nextest run -p alien-preflights --no-fail-fast (339 passed)
• cargo fmt -p alien-preflights -- --check
• git diff --check

Linear: ALIEN-945

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because the newly exempted workload controllers already wait for linked resources and resolve completed Sandbox bindings at runtime.

Summary

This PR narrows the Live Sandbox link validation so runtime-provisioned Containers and Daemons are accepted while setup-rendered consumers remain rejected.

• Adds explicit Container and Daemon exemptions to the setup-time binding check.
• Retains the rejection and clearer diagnostic for Workers and other setup-rendered consumers.
• Adds coverage for accepted Container and Daemon links and preserves coverage for rejected Worker links.

_{Reviews (1) · Last reviewed commit: "fix: allow runtime workloads to link liv..."}