[anilkreddy]

The public control API currently uses the internal-looking __mock namespace. This change gives the public sandbox control plane a clear, versioned contract before website and documentation consumers are added.

Changes

• Renames /__mock/* control routes to /sandbox/v1/*, including health and run lifecycle operations.
• Renames /openapi/mock.json to /openapi/sandbox.json and the source specification to sandbox-control.yaml.
• Renames the optional correlation header from x-mock-run-id to x-sandbox-run-id and updates CORS.
• Renames internal control route/error symbols while retaining the already provisioned private MOCK_JWT_* runtime secret names.
• Adds the health operation to the Sandbox Control OpenAPI document and verifies all 10 sandbox operations against registered Hono routes.
• Verifies the retired __mock and mock OpenAPI endpoints return 404 rather than maintaining an undocumented alias.
• Updates repository documentation, curl examples, deployment checks, and Worker-runtime tests.

This does not change SAP-compatible /v2 routes, /oauth2/token, /.well-known/jwks.json, or /openapi.json.

Validation

• pnpm run ci
• 10 test files and 47 tests passed
• Management OpenAPI: 52 operations validated
• Sandbox Control OpenAPI: 10 operations validated with route parity
• Wrangler deployment dry-run passed