Build the Linux LLVM helper and runtime pack before running both test lanes, and align native cache contracts with the current target policy. Full managed Sandbox gate passed.
* Improve Sandbox test portability - Decouple Sandbox scope and authentication from custom image references. - Add a pinned managed-image bootstrap with stronger preflight diagnostics. - Document and test OIDC, access-token, and fallback-image workflows. * Fix VCR OIDC authentication - Map selected credentials onto the VCR CLI token interface. - Decode OIDC project scope and cover auth paths with regression tests. * Fix Sandbox VCR authentication * Fix OIDC Sandbox scope precedence