Sandbox DevX: locked Edit in sandbox with upsell (no-sandbox plans)

[elias-ba]

As a user on a plan without sandboxes looking at a live workflow, I want to see Edit in sandbox present but locked with a clear upsell, so that I know sandboxes exist and how to unlock them, while Switch to draft stays my available editing path.

Part of #4852 (Sandbox DevX epic). Companion to Edit in sandbox (#4859), covering the "without sandboxes" path from the design.

Outcome

On a live workflow where sandbox provisioning is not allowed, Edit in sandbox is visible but disabled, with an always-visible upsell, and Switch to draft is the working secondary action. This is the non-sandbox path shown in the design walkthrough.

Acceptance criteria

• Given a live workflow on a plan or role without sandbox provisioning, then Edit in sandbox is shown but disabled, with an always-visible upsell tooltip.
• The upsell copy comes from the usage-limiting extension, not hardcoded.
• Switch to draft remains available as the secondary action.

Scope

• Show Edit in sandbox in a locked state driven by a permission or usage-limit flag on the session context (this flag was deferred from the Edit in sandbox work, where the action is currently shown to everyone and the server enforces provisioning).
• Surface the limiter's upsell message on hover.
• Keep Switch to draft as the fallback.

Key surfaces

Editor header, session context permissions/limits, the usage-limiting extension.

Note

Split out from #4859, which deliberately deferred client-side gating and the session-context permission flag.

[elias-ba]

Duplicate of #4920. Closing in favor of that one.