Use secret-backed agent builder runtime

agent_builder/tools.py

@@ -305,9 +305,14 @@ def build_tools(ctx: ToolContext) -> list[Any]:
             "echo '--- card ---'\n"
             "a2a card --project .\n"
         )
+        headers = (
+            {"authorization": f"Bearer {settings.sandbox_token}"}
+            if settings.sandbox_token else None
+        )
         async with httpx.AsyncClient(timeout=settings.sandbox_timeout_s + 30) as c:
             r = await c.post(
                 f"{settings.sandbox_url}/v1/run_shell",
+                headers=headers,
                 json={
                     "bucket": bucket, "script": script,
                     "image": settings.image, "memory_mib": 512,