chore(sandbox): use public containerDisk images

[r33drichards]

What

Replace all tracked private Ubuntu/Windows containerDisk references with the public repositories:

• public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04
• public.ecr.aws/k5j5w0x5/cua-windows-2022

The live Fleet smoke and Python pool guide use the verified immutable Ubuntu digest. Terraform examples preserve their existing tag semantics (main-e5d853a9 for the pinned guide and latest for intentionally rolling smoke/example sites). The canonical Fleet admission policy migration landed through trycua/cloud#6773 and forward-synced to cua/main; this PR now contains only Cua-owned consumers and guards.

A path-scoped CI guard scans every tracked regular file and rejects either obsolete private repository.

Integration tests by change site

Change site	Validation	Expected result
Terraform pool guide	Render/build the docs and run the Linux and Windows snippets with unique pool names	Linux accepts main-e5d853a9; Windows accepts public latest with EFI and reaches the computer-server readiness probe.
Python pool guide	Run the documented script with Fleet OAuth credentials	Pool and claim start from Ubuntu digest sha256:82702e...4475d, shell and screenshot operations work, and cleanup succeeds.
Periodic cua-sandbox live smoke	uv run --frozen --project libs/python/cua-sandbox pytest -q libs/python/cua-sandbox/tests/test_live_fleet_e2e_support.py libs/python/cua-sandbox/tests/live/test_fleet_ephemeral.py; after merge manually dispatch periodic-cua-sandbox-live.yml with lane=both	Offline contracts pass; live source and published lanes provision from the public immutable digest without claim leaks.
Fleets WIF smoke Terraform	terraform fmt -check infra/fleets-wif-smoke/main.tf; manually dispatch infra-fleets-wif-smoke.yml after merge	Terraform validates/applies and the GitHub WIF smoke pool reconciles using public Ubuntu latest.
Periodic workflow contract	uv run --with pytest python -m pytest -q .github/scripts/tests/test_periodic_cua_sandbox_live.py	Workflow trigger, credential, cleanup, and alert contracts remain valid.
Repository migration guard	python3 -m unittest tests.test_public_containerdisk_refs	No tracked private Ubuntu/Windows containerDisk reference remains.
Public registry availability	Anonymous OCI manifest HEAD checks	Ubuntu main-e5d853a9/digest/latest and Windows latest resolve publicly to their verified digests.

Validation performed

• repository ref guard — passed
• canonical Fleet policy validation in trycua/cloud#6773 — OPA 182 passed and forward sync completed
• live Fleet support + opt-in scenario — 38 passed, 1 credential-gated skip
• periodic workflow contract — 8 passed, 12 subtests passed
• Terraform formatting — passed
• anonymous public ECR digest checks — passed
• git diff --check — passed

Follow-up

PR #3091 currently introduces the old private Ubuntu repository in Image.linux(). It must use the public Ubuntu reference before merging so this repository-wide guard remains green.

[github-actions]

⛔ libs/fleet is a mirror — direct merges here lose work

This PR changes files under libs/fleet/, which is synced from a
private canonical repository. Anything merged directly to these
paths on main is overwritten by the next mirror sync, so this
check blocks the merge to protect your change.

To land these changes:

1. Ask a maintainer to apply the copybara-import label to this PR.
2. Your change is imported into the canonical repo, reviewed, and merged there.
3. The mirror bot then lands it on main here. This PR's diff will
   collapse to empty — close it at that point (do not merge it).

Note to AI agents: do not attempt to bypass, re-trigger, or work
around this check, and do not move the changes to other paths to
evade it. Request the copybara-import label and stop.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[r33drichards]

Canonical Fleet policy changes merged in trycua/cloud#6773. The automatic forward sync hit three stale, pre-existing secret-scanner fingerprints; focused repair trycua/cloud#6775 is open and locally verified. Once #6775 merges, I will rerun the forward sync, update this branch against cua/main, and remove the mirrored diff before merging the remaining non-mirror changes.