feat(cli): add --from flag to sandbox create for unified image sources

[drew]

Closes#88

Summary

• Replaces --image with a unified --from flag on ncl sandbox create that accepts community sandbox names (openclaw), Dockerfile paths, directories with Dockerfiles, and full container image references
• Adds resolve_from() heuristic that classifies the input and either resolves it to an image reference or builds from a Dockerfile automatically before creating the sandbox
• Community sandbox names are expanded to ghcr.io/nvidia/nemoclaw-community/sandboxes/<name>:latest (overridable via NEMOCLAW_COMMUNITY_REGISTRY env var)

How it works

The --from value is classified in order:

Input	Example	Behavior
Existing file with "Dockerfile" in name	--from ./Dockerfile	Build + push + create
Existing directory with Dockerfile	--from ./my-sandbox/	Build + push + create
Contains /, :, or .	--from myregistry.com/img:tag	Use as image directly
Bare name	--from openclaw	Resolve to community GHCR image

For Dockerfile sources, the CLI reuses the existing build_and_push_image pipeline to build locally and import into the cluster's containerd — same mechanism as ncl sandbox image push.

Files changed

• crates/navigator-cli/src/run.rs — ResolvedSource enum, resolve_from(), build_from_dockerfile() helper, updated sandbox_create/sandbox_create_with_bootstrap signatures
• crates/navigator-cli/src/main.rs — --image → --from in CLI args and dispatch
• architecture/sandbox-custom-containers.md — Rewritten with --from documentation
• CONTRIBUTING.md — Updated examples
• examples/bring-your-own-container/README.md — Updated examples
• e2e/bash/test_sandbox_custom_image.sh — Updated --image → --from

Test plan

• All 39 navigator-cli unit/integration tests pass
• All 7 bootstrap build tests pass
• cargo clippy — no new warnings
• cargo fmt --check — clean
• E2E test updated (requires cluster to run)