fix(security): redact delegated token in formatted output

[BhautikChudasama]

Summary

• Redact plaintext delegated sandbox tokens from the create/rotate response object's default string or debug output.
• Keep direct token access for callers and API response decoding unchanged.
• Add a regression check and changelog note.

Reason

Logging an entire create/rotate response could disclose the delegated credential. Explicit access to the token field remains available when the caller needs to store or pass it to a worker.

Verification

• Python tests and Ruff checks passed.