feat: make Python runtimes optional

[tianyuzhou95]

Summary

This PR splits the AKernel sandbox runtime into an RRT-only default profile and
an opt-in Python compatibility profile.

A normal all-in-one build now packages only the RRT sandbox runtime:

make build

Deployments that need Python actor runtimes can preserve the existing Python
3.10 through 3.14 environment explicitly:

make build RUNTIME_PROFILE=python

This keeps the default image aligned with the AKernel SDK's default
openyuanrong-sandbox backend, which uses sandboxd and does not require the
Python actor runtime.

Runtime profiles

The rrt profile contains the RRT executable and the minimal userspace needed
to launch it, including CA certificates, libgcc, a shell, and tini. It does
not download or package uv, standalone Python distributions, Python virtual
environments, or openyuanrong_sdk.

The python profile extends the RRT rootfs and preserves the existing Python
3.10, 3.11, 3.12, 3.13, and 3.14 runtimes. Each Python environment includes
FastAPI, Pydantic, Uvicorn, and openyuanrong_sdk for actor-backend
compatibility.

The runtime Dockerfile places the complete runtime-rrt target before all
Python stages. Both BuildKit and Docker's legacy builder can therefore finish
the default target without evaluating Python-only stages or downloading their
dependencies.

Both profiles continue to produce the same EROFS artifact path consumed by the
node image.

Build and node behavior

RUNTIME_PROFILE is passed from the Makefile to build-image.sh. The build
script selects either the runtime-rrt or runtime-python Docker target and
passes the same profile to the node image. Unsupported values fail before the
build starts.

The YuanRong service configuration is split to match the selected artifact:

• The default configuration registers only rrt.
• The Python configuration registers rrt, py310, py311, py312,
  py313, and py314.

The node image selects the corresponding service configuration through
AKERNEL_RUNTIME_PROFILE. This prevents an RRT-only node from advertising
Python functions that are not present in its runtime artifact.

The all-in-one control-plane image still contains the system Python packages
required to install and run OpenYuanRong core components. The RRT-only change
applies to the sandbox runtime EROFS artifact, not to the node control plane.

SDK compatibility

This PR does not change the AKernel SDK API or backend selection behavior.

The default openyuanrong-sandbox backend works with both runtime profiles.
It creates and controls sandboxes through sandboxd and requires only the RRT
function registered by the default profile.

Users who explicitly select the actor backend must also select the Python
runtime profile:

export AKERNEL_BACKEND=openyuanrong-sdk
make build RUNTIME_PROFILE=python

Using AKERNEL_BACKEND=openyuanrong-sdk with the default RRT-only image is not
a supported combination because the Python functions and actor runtime are not
registered.