Document and harden plugin sandbox operations for Cloudflare and Node

[ascorbic]

Goal

The plugin sandbox story should be operationally clear before the plugin runtime contract freezes.

Scope

Cover Cloudflare Dynamic Worker Loader and Node/workerd sidecar setups, including resource-limit semantics and failure modes.

Acceptance criteria

• Setup paths are documented for Cloudflare and Node/self-hosted deployments.
• Missing or unavailable sandbox runners produce actionable diagnostics.
• Resource-limit behavior is documented for both runners.
• Known differences between Cloudflare and Node runners are explicit.
• Failure modes are covered by tests or documented runbook guidance.