Sandbox apps may manage their own Codes releases (roadmap WS-N task 5): codes.release.manage joins the default sandbox allowance and openvibe.codes the audiences that accept sandbox app tokens (Codes keeps sandbox releases marked as such); the daily developer path now runs the release cycle

ddiff --git a/server/developer/policy.js b/server/developer/policy.js
iindex c731d4b7..37a2b6ce 100644
---- a/server/developer/policy.js
++++ b/server/developer/policy.js
@@@ -47,9 +47,10 @@ function grantableCatalog() {
  /**
   * Audiences that accept sandbox app tokens when DEV_SANDBOX_AUDIENCES is unset. Each of these keeps
   * sandbox traffic apart from real data: Media in a sandbox tenant, Events with env-marked events,
-- * Tools with sandbox jobs. openvibe.network is deliberately not one of them.
++ * Tools with sandbox jobs, Codes with sandbox releases (an app managing its own, WS-N task 5). openvibe.network
++ * is deliberately not one of them.
   */
--const DEFAULT_SANDBOX_AUDIENCES = Object.freeze(['openvibe.media', 'openvibe.events', 'openvibe.tools']);
++const DEFAULT_SANDBOX_AUDIENCES = Object.freeze(['openvibe.media', 'openvibe.events', 'openvibe.tools', 'openvibe.codes']);
  
  /**
   * Capabilities every project's SANDBOX apps may hold without a staff decision when
@@@ -63,6 +64,7 @@ const DEFAULT_SANDBOX_ALLOWANCE = Object.freeze([
      'media.object.upload', 'media.object.read', 'media.object.list', 'media.object.delete',
      'events.app.publish', 'events.app.read', 'events.app.subscribe',
      'tools.job.create', 'tools.job.read', 'tools.job.cancel', 'tools.tool.read', 'tools.tool.run',
++    'codes.release.manage',
  ]);
  
  /** Public + grantable only (the rule for every allowance that is not set by staff by hand). */
ddiff --git a/test/developer-defaults.test.js b/test/developer-defaults.test.js
iindex 56fc8c0c..eff8c9d4 100644
---- a/test/developer-defaults.test.js
++++ b/test/developer-defaults.test.js
@@@ -66,9 +66,9 @@ async function withoutCatalog(hidden, fn) {
  (async () => {
      // ── Settings: defaults, env overrides, and the public-only rule ──
      let s = policy.settings({});
--    assert.deepStrictEqual([...s.sandboxAudiences].sort(), ['openvibe.events', 'openvibe.media', 'openvibe.tools']);
++    assert.deepStrictEqual([...s.sandboxAudiences].sort(), ['openvibe.codes', 'openvibe.events', 'openvibe.media', 'openvibe.tools']);
      assert.ok(!s.sandboxAudiences.has('openvibe.network'), 'Network itself never defaults to accepting sandbox tokens');
--    assert.deepStrictEqual(s.sandboxAllowance, ['events.app.publish', 'events.app.read', 'events.app.subscribe',
++    assert.deepStrictEqual(s.sandboxAllowance, ['codes.release.manage', 'events.app.publish', 'events.app.read', 'events.app.subscribe',
          'media.object.delete', 'media.object.list', 'media.object.read', 'media.object.upload', 'tools.job.cancel', 'tools.job.create', 'tools.job.read', 'tools.tool.read', 'tools.tool.run'],
          'the default sandbox allowance (openvibe-contracts 0.59.0 defines media.object.list and .delete)');
      assert.deepStrictEqual(policy.DEFAULT_SANDBOX_ALLOWANCE.filter(id => id.startsWith('events.')), ['events.app.publish', 'events.app.read', 'events.app.subscribe']);