fix(api): do not log client cancellation as a sandbox create failure

[AdaAibaby]

Problem

Fixes #3683.

When a client disconnects (or its SDK gives up) before the API finishes creating a sandbox, the request context is cancelled. Because the context is threaded end-to-end through placement, the in-flight create/reserve is cut and surfaces as a generic failure. Two hot paths in packages/api treated this expected context.Canceled as a server-side failure — they logged at ERROR and (in placement) incremented the node's createFails counter and excluded it for the rest of the attempt.

The access-log/metrics middleware already rewrites the HTTP status to 499 by cancel cause, yet the handler's own ERROR logs and telemetry spans still recorded these as 500, so a single client cancellation was recorded twice with two different codes. This is the same class of issue already addressed for envd (#3647) and NBD dispatch (#3274, #3348), on the API create path.

Changes

• Placement loop (placement/placement.go): a create cut by its own context now Skips the node instead of Failing it, logs at Warn instead of ERROR, and does not exclude the node — a client disconnect says nothing about the node's health. The attempt is still counted so deadline() classifies the timeout correctly, and the loop still ends with the caller (returns deadline()). Genuine live-context failures are unchanged: they still Fail, exclude, and log at ERROR.
• Reserve path (create_instance.go): a reservation cut by context.Canceled / context.DeadlineExceeded now logs at Warn instead of ERROR. Mirrors the existing guards in outbox/river.go, orchestrator/autoresume.go, handlers/proxy_grpc.go, and featureflags/flags.go.

Client-facing behaviour is unchanged (still 499/408 via the middleware); this only stops the duplicate ERROR logs and the createFails inflation driven by client behaviour. Scheduling was already unaffected (best-of-K scores on InProgress(), which is cleaned up by both Skip and Fail).

Tests

• Added TestPlaceSandbox_CutCreateNotCountedAgainstNode: a create that cancels the request context mid-flight must report a timeout, keep FailsCount at zero, and drop its in-progress reservation.
• Strengthened TestPlaceSandbox_HardFailureNotWrapped to assert a live-context failure still counts against the node (FailsCount == 1), guarding the two branches against regressing into each other.
• go test ./internal/orchestrator/placement/... passes. go vet and golangci-lint clean on the changed packages. (The DB-backed orchestrator tests require PG_TEST_DATABASE_URL, unavailable in my env; the paths changed here have no DB dependency.)