The ESM port of `createApi` (#2683, shipped in 21.1.0) replaced  `createSandbox: createSandbox` with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

    createSandbox: function createSandbox(config) {
        const s = createConfiguredSandbox(config);
        sandbox.getFakes().push(s);
        return s;
    }

`Sandbox#restore` then walks that collection and calls `.restore()` on each entry. Because a sub-sandbox is itself an entry, every top-level `sinon.restore()` cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits `resetHistory` and
`verifyAndRestore`. This is the regression reported in #2701.

Restore the pre-21.1 behaviour: hand the root API a direct reference to `createConfiguredSandbox`. Sub-sandboxes are now isolated; only `subSandbox.restore()` (or `verifyAndRestore`) clears their fakes.

Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
end.

Closes #2701