Adopt Sandbox credential brokering when it ships #64

Context

The model key already stays out of sandboxes: Claude runs on the workflows host, and only its tool calls run in a sandbox (app/claude.ts).

The GitHub push credential does enter a sandbox. inAppsClone (app/publish.ts:221) creates a fresh sandbox, and execGitWithToken (app/git.ts:50) gives Git the token through a temporary askpass script to clone and push the apps repository. The mitigation is that no agent ever uses that sandbox, which keeps the build sandbox free of credentials but costs a second sandbox and a clone per push.

Task

When Render Sandboxes ships credential brokering:

• Clone and push the apps repository with a brokered credential, so the token never enters any sandbox. Remove the askpass script handling in execGitWithToken.
• Decide whether the separate publish sandbox is still needed. Pushing from the build sandbox would still need care, because the agent's code ran there.
• Update the "Trust boundaries" section of docs/2_ARCHITECTURE.md, docs/3_TAKEAWAYS.md, and the related tests.

Blocked on the platform feature; keep this open as a tracking issue. Related: render-examples/codebase-researcher#15 and render-examples/software-factory#45.

Status (Oct 28): still blocked. @renderinc/sdk 1.5.0 has no credential brokering; its only sandbox credential is registryCredential for sandbox builds. Once #72 merges, the publish sandbox can reach only github.com, which narrows where the token could go in the meantime.