sdk: derive facade Criteria from Snapshot

[mchmarny]

Summary

The documented snapshot-to-recipe path still imports internal pkg/fingerprint and evolving pkg/recipe. This contradicts #2016's acceptance bar that an integrator can complete the workflow using only pkg/client/v1.

Proposed change

Add a facade-owned snapshot-to-criteria operation returning *aicr.Criteria and using the Client's provider-scoped criteria registry. Route the CLI and compiled example through it.

Acceptance criteria

• Snapshot-derived criteria require only pkg/client/v1.
• The CLI no longer imports pkg/fingerprint for this workflow.
• The integrator guide removes the unstable-package escape hatch.
• New surface is stability-pinned and API-diff covered.
• Tests cover nil/invalid snapshots and representative provider/GPU criteria.

Parent: #2016

[mchmarny]

Triaged at creation: P1 / Ready / v1. This closes the remaining documented unstable-package escape hatch in epic #2016.