fix: gate assertAwsDeployImage on usesFlySandboxes

[Ruchirtripathi]

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Ruchirtripathi]

The Fix

This PR resolves the issue by gating all call sites of assertAwsDeployImage(config) behind the
!usesFlySandboxes(config) check.

Changes Made:
Modified cli/src/backends/aws.ts to add conditional gates at the four main execution phases where
assertAwsDeployImage is invoked:

1. Pre-deployment network validations in awsUp()
2. Pre-deployment state snapshotting in awsUp()
3. Health validations in awsDoctor()
4. Drift validations in checkLive()

How it Works:
By wrapping the assertions with if (!usesFlySandboxes(config)) { ... }, the AWS backend now natively understands
that Lambda MicroVM validations are entirely unnecessary when the deployment relies on Fly.io for its sandboxing
backend.

Users deploying the control plane to an unsupported AWS region (like eu-central-1) with sandbox.backend: "sprites"
can now successfully run qm plan and qm up without encountering the irrelevant AWS requires exact
env.core.AWS_DEPLOY_IMAGE exception.

[Ruchirtripathi]

solves #177

[rajpratham1]

This is a straightforward correctness fix that aligns validation with the selected deployment architecture.

What the PR fixes

Previously, assertAwsDeployImage(config) was executed unconditionally in multiple places, even when the deployment was configured to use Fly sandboxes instead of AWS Lambda MicroVM sandboxes.

The PR consistently guards those checks:

if (!usesFlySandboxes(config)) {
assertAwsDeployImage(config);
}

This ensures the AWS deploy image is only validated when it is actually relevant.

Why this is correct

The deployment image is only required for AWS-hosted Lambda MicroVM sandboxes.

For configurations using Fly sandboxes:

there is no AWS deploy image to validate,
failing validation is a false positive,
users should not be blocked by an irrelevant prerequisite.

The change correctly ties the validation to the deployment mode instead of always enforcing it.

Consistency improvements

The PR updates all of the major call sites:

✅ initial deployment validation
✅ deployment snapshot path
✅ diagnostic/health checks
✅ drift detection

This avoids inconsistent behavior where some commands might still require an AWS deploy image while others don't.

Code quality

The implementation is:

minimal,
easy to understand,
consistent across the file,
low risk.
Minor suggestion (non-blocking)

The repeated pattern:

if (!usesFlySandboxes(config))
assertAwsDeployImage(config);

now appears several times. If similar deployment-mode gating continues to grow, it may eventually be worth introducing a small helper (or central validation routine) to avoid repeating the same conditional logic. This is purely a maintainability suggestion.