Task: Default the import wizard and web to the sample sandbox

Every import path (shell, Qt wizard, web) lands in a sandbox unless the user picks an official target on purpose. Today only a choices file can name a sandbox.

• An import with no choice never creates a portfolio or book in the official tree. It lands in the party's open sample sandbox, or it fails.
• The caller can choose the official tree on purpose.
• The import can be proven for a second party, with a way to choose the party for the session.
• The Qt wizard and the web import offer the party's sandboxes. This tree has neither screen, so this part moves to the task that adds them.

The server decides, so every client gets the default: the import service picks the sandbox when the choices name none. A client that wants the official tree says so with official.

1. Add official to the import choices, optional so that older choices files still parse.
2. In the import handler, when the choices name no sandbox, no existing parent portfolio, no existing target book and not official, read the open sample sandboxes and keep the one whose anchor portfolio belongs to the importing party.
3. Fail the import with a clear message when the party has no such sandbox. Never fall back to the official tree.
4. Add --official to the shell ore import.
5. Prove it on a clean database for two parties.

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

• The tree has no Qt import wizard and no web import screen. The shell is the only client. The server default covers the other two when they arrive.
• The first draft listed every sample sandbox of the tenant and took the first by name. A tenant administrator sees the sandboxes of all parties, so the import took the sandbox of another party. A sandbox has no party of its own, so the lookup now reads the anchor portfolios and keeps those of the importing party.
• A way to choose the party for the session already exists: accounts set-default-party <name>, then log in again. It works once the tenant has left bootstrap mode. In bootstrap mode the login always opens the tenant's system party.
• Found, not fixed: the tenant setup stops at its attach_photos step with "The picture was not attached to the account 'ores_bright_faraday_analytics_service': Account does not exist". The tenant then stays in bootstrap mode and the administrator signs in to the system party. It repeated on three clean provisions. I cleared system.bootstrap_mode for the tenant with SQL on my local database to continue. This is not caused by this task.
• The services in the proof ran a build that differed from the final one only in the text of one error message.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

An import that names no sandbox now lands in the importing party's open sample sandbox. If the party has none, the import fails with a message, and the official tree stays untouched. official in the choices, or --official in the shell, picks the official tree on purpose. An import that names an existing parent portfolio or target book also counts as an official choice.

Proven on a clean database for two parties (see Measurements). Not done: the Qt and web screens, which do not exist here; a unit test of the lookup, which needs a NATS stand-in; the attach_photos failure above.