fix: creates by template tag, the envd-proxy smoke's node token, the chart's token requirement

[CMGS]

Four commits on master 85dd5ea:

• fix(e2bcompat): a create may name a built template by one of its tags. Template.build stores app:v1 as app with tag v1, but the create path handed the whole app:v1 to resolveTemplate, which indexes bare names, so every tagged reference answered 404 (P2 from CMGS, also reported by Codex). name:tag now resolves to the template when the tag is one of its live tags, name:default to the current build; an unknown tag or one whose digest no holder reports stays 404. Regression test fails on the old code with template "app:v1" not found. Docs row updated.
• fix(envdproxysmoke): the harness passes the node token NewServer requires since 40002c8 (-node-token); it exited at once before. Docs command lines updated.
• fix(helm): the envd proxy's chart requires apiserver.sandboxdToken.secretName when e2b is enabled (the proxy exits without the token); helm lint and a render with the secret pass, a render without it fails with the reason.
• review(envdproxy): the probe comment follows the code (401 since cut: closing round 2026-09-28 cut-list, promoted fallback opt-in, paused relay message #80).

The first three are cocoonstack-1's docs re-check findings 1–3 plus CMGS's P2; finding 5 is sandbox #262, finding 6 is sandbox #264.