Clear bot-flagged test nits and annotate the sandbox workspace path

Wrap a storage read in a context manager (close the file handle), add a comment
on the expected SandboxCapacityError in the churn test, and unify the
artifacts-routes test on a single import style. Also annotate the intentional
per-session sandbox workspace path with # nosec B108 (controlled dir inside the
runner container, not an insecure shared temp file).

tests/api/user/test_artifacts_routes.py

@@ -486,7 +486,7 @@ class TestMalformedArtifactId:
         self, _patch_db, flask_app, token_owner, resource_name,
         extra_args, method, json_body,
     ):
-        import application.api.user.artifacts.routes as routes_mod
+        from application.api.user.artifacts import routes as routes_mod
 
         resource_cls = getattr(routes_mod, resource_name)
         resp = _call(