Improve Sandbox test portability (#240)

* Improve Sandbox test portability

- Decouple Sandbox scope and authentication from custom image references.
- Add a pinned managed-image bootstrap with stronger preflight diagnostics.
- Document and test OIDC, access-token, and fallback-image workflows.

* Fix VCR OIDC authentication

- Map selected credentials onto the VCR CLI token interface.
- Decode OIDC project scope and cover auth paths with regression tests.

* Fix Sandbox VCR authentication

* Fix OIDC Sandbox scope precedence