chore: Pin trueforge-clone-tfy-sandbox SHA in deploy-devtest sync.

[sr07asthana]

Include the sandbox service manifest alongside trueforge and controller so devtest deploys stay on the same commit.

Summary

Closes #

Changes

How was this tested?

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, python/trueforge_sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Low Risk
CI-only change to which deployment manifests get SHA-pinned; no runtime or application logic affected.

Overview
Extends the deploy-devtest workflow so pushes to main also update trueforge-clone-tfy-sandbox.truefoundry.yaml in the devtest deployment repo, not just trueforge and trueforge-controller.

The pin step sets the same image.build_source.ref and branch_name on all three manifests and stages the sandbox file in the bot commit, keeping sandbox devtest deploys on the same commit as the other services.

^{Reviewed by Cursor Bugbot for commit 2734442. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2734442

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR