Create a workspace-scoped sandbox from an image or snapshot with explicit resource controls. This operation accepts top-level resource shortcuts such as image, snapshotId, cpuMillis, memoryMb, gpuCount, and workspaceId, plus advanced options like secretRefs, volumeMounts, and TTL behavior.