Declarative validation for ActorTemplate

[shrutiyam-glitch]

Continues the declarative-validation (DV) migration from #1215, covering the ActorTemplate resource, its full spec tree, the create path, and read/delete verbs.

Key Changes

• DV Tags & Hooks: Added validation tags and custom hooks across the ActorTemplate spec (Metadata, SandboxConfig, SnapshotsConfig, Container, Volume, Resources).
• Create Path: Replaced hand-written validation with generated validators in CreateActorTemplate. Custom rules (e.g., on_commit ⊆ on_pause) are now handled via custom hooks.
• Read/Delete Verbs: Converted Get, List, and Delete requests to use DV.
• State Updates: Refactored atepg metadata setters to update in-place.
• Regenerated apitool exemptions (documented 15 previously-exempt fields).

Deliberate Behavior Changes
The gRPC path now strictly enforces CRD rules. Specific tightenings include:

• Empty worker_selector is now rejected.
• EnvVar.name is strictly required.
• Negative values in optional enum fields are rejected (minimum=1).
• page_token is capped at 256 characters (matching other list requests).

Deliberately Not Done

• No update DV / status tags: ActorTemplates are immutable to clients. The reconciler updates the status directly against the store, so tagging the status subtree or adding update validation isn't necessary right now.
• config_name matching sandbox_class: Enforcing this requires calling SandboxConfigLister (ServiceImpl), so it's left as a TODO.

Testing

• Added ~70 positive and negative test cases in the validator tables.
• Store-backed tests (TestCreateActorTemplate*, TestUpdateActorTemplateMetadata, and the atepg suite) verified against real Postgres via testcontainers.

• Tests pass
• Appropriate changes to documentation are included in the PR