CORS preflight for the public-sandbox summary endpoint

CORS preflight for the unauthenticated public-sandbox surface (/api/v1/sandbox/public/*). Differs from the internal SandboxOptionsPreflight in three places: (1) Allow-Methods is GET, POST, OPTIONS — the public surface is unified across both verbs because every public-sandbox endpoint shares one handler factory; (2) X-Robots-Tag: noindex is set so the JSON API surface never lands in a search index even if a crawler stumbles onto it; (3) X-Apier-Sandbox: public is set as the agent-facing detection signal (SDKs branch on this header to distinguish the public from the internal sandbox without parsing the URL). Access-Control-Allow-Credentials is INTENTIONALLY absent — public sandbox is zero-auth and must not advertise credential support.