Classify node readiness without vendor codes

[SaladDay]

Node readiness is reported in six Provider-neutral classes instead of vendor-named codes.

Old code	Class
docker_unavailable	provider_unavailable
docker_limits_unsupported, kvm_unavailable	host_unsupported
microsandbox_artifacts_unavailable	artifacts_unavailable

runtime_download_failed, runtime_image_unavailable and capacity_insufficient are unchanged.

• node_diagnostic.go stays the one authored list. The sandbox package exports one error per class. Probes wrap the class error and keep the vendor detail in the local error text, which never crosses the transport. The vendor-named errors are gone.
• Projections: the shared fixture, the OpenAPI enums (make openapi), the agents-client list and normalizer, and Web's per-class advice and locales. The advice is Provider-neutral and points to the installer preflight and node logs for the local detail.
• Stored values: migration 000095_node_readiness_classes.sql rewrites stored codes to their classes, so no API response can return a removed code. The node wire protocol version is unchanged, because the field stays a string with the same validation.
• Docs (en and zh): node-generation-protocol.md, sandbox-deployment.md, getting-started/nodes.md and web/console-api-usage.md. The protocol doc now matches the code: a frame whose diagnostic is not a declared class is invalid.

Checks: go build, go vet; Go tests for sandbox, sandbox/node, sandbox/providers, deployment/..., cmd/sandbox-node and deploymentpg against a database, including the migration test; make openapi with no extra diff; agents-client typecheck and tests; Web typecheck and the sandbox and lib vitest files; check-names; translations. The live Docker transport test was skipped (no fixture image). e2e/nodes.spec.ts is updated and left to CI.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}