fix(sandbox-backend): confirm renewed boundary credentials within an epoch

[shiju-nv]

Summary

Confirm a refreshed workload-boundary bearer even when its credential epoch is unchanged. A long-lived workload using only existing streams can otherwise lose its boundary at the original credential expiry despite successful gateway renewal. The correction authenticates the replacement while preserving the connection and pending operations.

Related Issue

Related to #3396's boundary/proxy incident and additive to TCP-recovery PR #3403.

Changes

• Capture one authorization header and fingerprint that exact bearer, so a concurrent token-slot update cannot make the cached identity describe a different request.
• Confirm a replacement bearer on the active connection when the epoch is unchanged. Publish the fingerprint only after confirmation succeeds and the connection generation still matches.
• Retain existing changed-epoch recovery and TCP transport behavior; PR fix(sandbox-backend): recover TCP mediation after boundary disconnects #3403 owns native TCP accept recovery.
• Add protocol regressions for same-epoch renewal with a pending stream, failed confirmation and retry, and a token-slot update after credential capture. Document the authentication boundary in the existing architecture overview.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)