[terra-bench]: sandbox proxy, redaction, and CI security

[skrishnan22]

No description provided.

[greptile-apps]

Greptile Summary

This PR hardens sandbox proxying, provider handling, and CI security. The main changes are:

• Adds short-lived sandbox proxy capabilities for LLM, Git, and WebSocket access.
• Routes sandbox Git operations through a credential helper and session proxy.
• Updates provider validation, model catalogs, and provider configuration handling.
• Adds redaction, telemetry, event-log, and sandbox image hardening changes.
• Pins CI actions, updates Node and package versions, and adds sandbox image smoke checks.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
packages/sandbox-image/src/git-driver.ts	Adds the Git proxy credential helper, rotating capability file, GitHub URL rewriting, and proxy-backed clone, refresh, and push behavior.
packages/worker/src/sandbox-proxy.ts	Adds Git proxy route handling for bare and .git repository paths with read/write smart HTTP checks.
packages/sandbox-image/src/entrypoint.ts	Adds sandbox proxy token parsing, WebSocket token handling, and a separate capability refresh path.
packages/sandbox-image/src/runtime.ts	Applies refreshed proxy capabilities to the sandbox runtime, Git driver, and live agent.

_{Reviews (2): Last reviewed commit: "Harden sandbox proxy from review: shared..." | Re-trigger Greptile}