docs(verification): rewrite framing for (Sandbox) verdict (closes docs half of #4380)

[bokelley]

Summary

Three pages updated to reflect the #4379 (Sandbox) verdict. Closes the docs half of #4380.

Changes

`aao-verified.mdx`

• Front-of-page framing rewritten around (Sandbox): same storyboard suite as (Spec), targets registered production URL with `account.sandbox: true`, zero real-world side effects
• "What each axis certifies" tables updated
• "How agents earn each axis" — (Sandbox) earn instructions describe the seller-side sandbox-account gate
• Reading-a-badge display rows updated
• Lifecycle for (Sandbox) — cross-mode leakage as immediate-revoke trigger
• JWT `verification_modes` — `["spec"]` or `["spec", "sandbox"]`
• Supporting specs — comply_test_controller: pin account.sandbox at the request envelope #3755/spec(comply_test_controller): add account.sandbox gate (closes #3755) #4382 (schema gate), spec/compliance: storyboard coverage gap — no scenario exercises comply_test_controller denial against live-mode accounts #4028/feat(compliance): comply_controller_mode_gate storyboard + acme-outdoor-live kit (#4028) #4384 (mode-gate storyboard), Runner grades force_create_media_buy_arm UNKNOWN_SCENARIO as failed instead of not_applicable #4226/spec(compliance): force_scenario_unsupported — UNKNOWN_SCENARIO on force_* steps grades not_applicable #4228 (UNKNOWN_SCENARIO grading)
• Warning banner above the deprecated canonical-campaign sections (eight observability checks, webhook ownership, two discovery paths, maintenance windows) — full removal in follow-up sweep

`conformance.mdx`

• "Two words, not three" — (Sandbox) replaces (Live)
• "Storyboard conformance vs. AAO Verified" — both qualifiers run the same storyboards; (Sandbox) is the stronger claim

`comply-test-controller.mdx`

• Prominent Note callout at the top: controller is dev/staging-only, AAO grading does NOT require or use it. Connects to (Sandbox) framing via RFC: Verified (Sandbox) — reframe Verified (Live) to attest production-surface sandbox tolerance instead of canonical-campaign delivery #4379.

What's deferred (tracked in #4380)

• Full removal of the deprecated canonical-campaign sections from `aao-verified.mdx` — they remain behind the Warning banner for historical context. ~100 lines of detailed content (eight observability checks, Path A/B, maintenance windows, webhook ownership) will be pruned in a follow-up.
• Migration guide for existing (Spec)-earner agents moving to (Sandbox) — separate rollout doc once the cutover plan is set.

Push A status

This is the final piece of Push A (compliance reporting fidelity):

• ✅ fix(compliance): rewrite deriveStoryboardStatuses for SDK 6.x scenario keys #4364 — storyboard parsing fix
• ✅ fix(addie): owner evaluate_agent_quality writes to canonical compliance state #4250 + feat(dashboard): surface verdict_source + per-run triggered_by badge #4263 — owner-canonical + dashboard verdict_source
• ✅ fix(dashboard): drop unfiltered /api/storyboards fallback (closes #4254) #4369 — dashboard filter applicable-only
• ✅ docs(verification): storyboards vs. scenarios disambiguation (closes #4035) #4373 — storyboards-vs-scenarios disambiguation
• ✅ feat(dashboard): storyboard count as canonical compliance headline #4374 — canonical-surface storyboard headline
• ✅ This PR — (Sandbox) framing docs

🤖 Generated with Claude Code