feat(sandbox): raw mode for SandboxNextProvider (K8s manifest passthrough)

[Generalwin]

Closes #1344

Summary

Add a raw mode to SandboxNextProvider: when the E2B link finds no READY template in the DB, the provider renders a full BatchSandbox CRD manifest and passes it through to the SandboxManager Control HTTP API as a JSON string in the body raw field — a flexible escape hatch for anything the structured resource_spec fields cannot express.

Changes

• rock/admin/service/e2b_service.py: when no READY template matches, clear template_id and set extended_params["use_raw"]="true" (request image becomes the container image).
• rock/sandbox/operator/remote/providers/sandbox_next_provider.py: submit branches into template / raw / resource_spec paths (template_id wins over use_raw); raw path renders via K8sTemplateLoader.build_manifest and sends {"raw": "<manifest json>"}; port_mapping is read from the template ports instead of being hardcoded.
• rock/config.py: new RemoteOperatorConfig.templates field (same structure as K8sConfig.templates).
• rock/sandbox/operator/remote/constants.py: EXT_USE_RAW / EXT_USE_RAW_ENABLED extended_params keys, following the K8s pool_name/template_name precedent.
• rock/utils/format.py: normalize_memory_to_k8s for rendering K8s-style quantities (K8s provider keeps its own copy untouched).
• Docs + RemoteOperatorConfig.templates YAML example in docs/proposals/remote-operator.md.

Test plan

• New unit tests: raw request body (manifest string, labels, rendered resources), dynamic port_mapping from template ports, env_vars merge into containers, missing-templates error, template_id precedence, E2B service raw decision both ways (tests/unit/sandbox/operator/remote/, tests/unit/admin/service/, tests/unit/utils/test_format.py)
• Full related suite passes: 305 tests
• E2E against the real gateway: submit (raw) → RUNNING in ~5s → rocklet (started via container command) alive on :8000 at t=20s → delete