Clear bot-flagged test nits and annotate the sandbox workspace path

Wrap a storage read in a context manager (close the file handle), add a comment
on the expected SandboxCapacityError in the churn test, and unify the
artifacts-routes test on a single import style. Also annotate the intentional
per-session sandbox workspace path with # nosec B108 (controlled dir inside the
runner container, not an insecure shared temp file).

tests/agents/test_workflow_input_documents.py

@@ -177,7 +177,8 @@ def test_attachments_bridge_to_run_scoped_artifacts(pg_engine, tmp_path, monkeyp
     # The bytes round-trip from storage (never entered state).
     with pg_engine.connect() as conn:
         v = ArtifactsRepository(conn).get_version(refs[0]["artifact_id"], 1)
-    assert storage.get_file(v["storage_path"]).read() == a1
+    with storage.get_file(v["storage_path"]) as fh:
+        assert fh.read() == a1
 
 
 def test_attachments_capped_per_run(pg_engine, tmp_path, monkeypatch):