Diagnostic surface moved out of normal work

Apply Sandbox is available only in Admin, Reviewer or CRAYS Management diagnostics.

Normal role workspaces now stay object/action-led: queues, cases, rooms, decisions and safe next steps. This prevents audit matrices and readiness walls from becoming the product experience.