docs: surface sandcastle image-build step (one-time setup)

Closes the gap the user hit running `pnpm work decompose --execute`:
sandcastle errored with `Image 'sandcastle:template-vertical' not
found locally. Build it first with 'sandcastle docker build-image'`,
but neither the README nor the runbook documented this step.

README.md: new "Sandcastle setup (one-time)" section after Quick
reference. Three commands (docker info, build-image, auth) — the
minimum needed to make dispatch work. Links to the runbook for the
full lifecycle.

docs/guides/runbook.md: Prerequisites in "Using Sandcastle" grow
from 4 to 5 items. New step 2 walks through `sandcastle docker
build-image`, quotes the exact "Image not found locally" error so
agents searching for the string land on the fix, and shows the
remove-image + rebuild flow for Dockerfile edits.

.sandcastle/README.md: new "Build the sandbox image (one-time)"
section parallel to the env section, cross-linking to the runbook.

scripts/work/decompose.mjs + scripts/work/dispatch.mjs: when the
sandcastle error message matches the "Image '.+' not found locally"
pattern, the dispatcher now prints the build-image command inline
above the generic "See runbook" line. The error stack itself remains
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/work/dispatch.mjs

@@ -234,6 +234,11 @@ async function executeDispatch() {
     });
   } catch (e) {
     console.error("✗ Implementer dispatch failed:", e.message);
+    if (/Image '.+' not found locally/.test(e.message ?? "")) {
+      console.error(
+        "  One-time setup: pnpm exec sandcastle docker build-image",
+      );
+    }
     console.error(
       "  See docs/guides/runbook.md → 'Using Sandcastle' for setup.",
     );