Inconsistent snapshot return types

[ludfjig]

snapshot() returns Result<Arc<Snapshot>>, but load() and checked_load() return Result<Snapshot>. Both from_snapshot() and restore() require Arc<Snapshot>, forcing callers to wrap loaded snapshots manually.

snapshot() needs shared ownership because the sandbox caches the snapshot while returning it to the caller. Loading creates a fresh value with no other owner, so returning Snapshot leaves ownership choices to the caller.

Potential fixes:

• Return Arc<Snapshot> from both load methods.
• Accept impl Into<Arc<Snapshot>> in from_snapshot() and restore() so either form works.
  *... something else