[Bug]: demos/sandbox client fails with missing bearer token on actor resume

### What happened?

## Summary
Running `demos/sandbox/client` fails when invoking `ResumeActor` against `ate-api` because the client establishes an unauthenticated gRPC connection without attaching a Bearer token.

## Steps to Reproduce
1. Port-forward the Substrate API server (`kubectl port-forward -n ate-system svc/api 8080:443`).
2. Run the sandbox client:
```bash
go run ./demos/sandbox/client --atespace=demo --name=sb1
```

## Actual Behavior
```text
2026/09/09 21:51:13 Connecting to ateapi at localhost:8080...
2026/09/09 21:51:13 Resuming actor sb1...
2026/09/09 21:51:13 Failed to resume actor: rpc error: code = Unauthenticated desc = missing bearer token
```

## Root Cause
`demos/sandbox/client/main.go` uses a custom `dialAteAPI()` helper that calls `grpc.NewClient` with TLS but omits `PerRPCCredentials` (Bearer JWT / ServiceAccount token). As a result, `ate-api`'s auth interceptor rejects the unauthenticated request.

### Expected Behavior

The client should authenticate with `ate-api` using the standard `internal/ateclient.NewClient`, which automatically:
- Obtains an `ate-client` ServiceAccount bearer token via the k8s TokenRequest API (or uses `--token-file`).
- Validates the serving certificate against `ClusterTrustBundle`.
- Injects bearer credentials into RPC requests.

### Steps to Reproduce

1. Deploy the sandbox demo on an Agent Substrate cluster:
` ./hack/install-ate.sh --deploy-demo-sandbox`

2. Create a sandbox actor:
` kubectl ate create actor sb1 -a ate-demo-sandbox --template sandbox-template`

3. Port-forward the API and router:
``` kubectl port-forward -n ate-system svc/api 8080:443 &
kubectl port-forward -n ate-system svc/atenet-router 8000:80 &
```

4. Run the sandbox client:
` go run ./demos/sandbox/client --atespace=ate-demo-sandbox --name=sb1`

5. Error:
` Failed to resume actor: rpc error: code = Unauthenticated desc = missing bearer token`

### Sandbox Runtime

gVisor (runsc)

### Agent Substrate Version / Commit SHA

0b3d2d078

### Kubernetes Version & Environment

_No response_

### Host OS & Architecture

_No response_

### Relevant Logs and Diagnostic Output

```shell

```

### Additional Context

_No response_

### Confirmation

- [x] I have searched existing issues and verified that this is not a duplicate.
- [x] I have verified that this issue occurs on the latest commit on `main`.