feat(api-rs): launch persona sandboxes

[goksu]

Summary:

• pass persisted harness_type and persona_id into sandbox spec creation
• set AGENT_PERSONA and CENTAUR_HARNESS_TYPE for app-server sandboxes
• choose codex, amp, or claude wrapper from the session's stored HarnessType
• keep warm-pool claims limited to profileless Codex sessions so prestarted pods are not reused with the wrong persona or wrapper

Tests:

• rustfmt --edition 2024 --check services/api-rs/crates/centaur-session-runtime/src/lib.rs
• cargo test -p centaur-session-runtime
• just build-one api-rs
• local Helm deploy with iron-control disabled for arm64 validation
• created amp persona session and executed once; launched pod had args=["amp-wrapper"], AGENT_PERSONA=eng, CENTAUR_HARNESS_TYPE=amp, and matching CENTAUR_THREAD_KEY