Fix Pydantic constraints in workflow sandboxes - #1914

Pydantic can silently ignore constraints when workflow sandboxes reload annotated_types, because its process-wide constraint cache uses class identity. Pass through annotated_types by default so constraints remain enforced inside and outside the sandbox.

Add regression tests in fresh processes for both host-first and sandbox-first model creation, covering Annotated metadata, Field, and conint, and add a changelog entry.

Fixes #1897.

Validation:

• Confirmed both regression cases fail before the fix and pass after it.
• Workflow sandbox suite: 29 passed, 1 skipped.
• Ruff import and formatting checks, Pyright for changed Python files, and git diff --check passed.
• Full poe lint was blocked by a pre-existing syntax error in an unrelated local OpenTelemetry edit, which is excluded from this PR.