[Security] Remove host-token compatibility on scoped routes

[Wauplin]

Summary

• Require each sandbox's capability token on all pooled sandbox routes: exec, files, processes, deletion and proxies. Remove the host-token fallback and the SBX_COMPAT_HOST_TOKEN setting entirely.
• Keep the host credential on pool management and scoped-token recovery. Dedicated mode is unchanged.
• Update the security regression scripts to use scoped credentials, so positive controls still reach the filesystem/process handlers. Add explicit 403 checks for the host token on scoped routes.

Breaking change: clients that send the host token on per-sandbox routes stop working. This intentionally removes compatibility, as requested after the security-stack review. Protocol advances from 2 to 3; clients already using scoped tokens work with either. Companion client: huggingface/huggingface_hub#4782.

Land the client first, then release this server and update the client's binary pin. No server or client release is performed by this PR. The host credential still manages the pool and can recover scoped tokens, so it remains sensitive.

GNU and musl unit suites: 51 passed each. Clippy with warnings denied passed. Manual privileged Docker token-scope regression:

=== host credentials never authorize scoped routes
  ok    exec (403)
  ok    files (403)
  ok    processes (403)
  ok    proxy (403)
  ok    delete one sandbox (403)
  ok    scoped token can delete its sandbox (200)
  ok    management can still delete all (200)

All eight root regression scripts passed in a privileged Docker container. The local kernel exposes Landlock ABI 4; this run does not establish ABI 6-specific isolation behavior.