feat: deploy-time default placement for Isolated instances

[imneov]

What

PR #21's adjudication correctly removed placement from the public instance API (ordinary users must not control scheduling). But that leaves operators with no supported way to steer Isolated Sandboxes toward nodes where the runtime images are available/pullable — the first real e2e run had to work around this with an ad-hoc CLAWMANAGER_ISOLATED_NODE_NAME env injecting a kubernetes.io/hostname nodeSelector (worktree-only change, not committed).

Provide a deploy-time configuration surface for default Isolated placement, consistent with the existing config philosophy (deploy-time env / platform settings, no per-user surface, ADR-0002 pass-through semantics):

• default nodeSelector (and optionally tolerations / runtimeClassName) applied to Isolated Sandboxes when no internal placement is supplied
• documented in the deployment docs; empty default = current behavior

Acceptance criteria

• Deploy-time config (env or settings) for default Isolated placement, applied in sandboxBackend pod template rendering
• Public API continues to reject caller-supplied placement (400) — unchanged
• Backend-seam tests: default applied when configured, absent otherwise
• Deployment docs updated

Refs

PR #21 adjudication (placement ruling), ADR-0002, first e2e run evidence (2026-07-17).