The error message is telling you the answer — it's likely a parameter type problem, not a sandbox problem.

Read the error carefully: Can't find method executeNow(string). It's not saying "access denied" or "class not found." It's saying it can't find an executeNow method that accepts a string parameter.

Your working background script passes a GlideRecord to discoverNow(). Most ATF attempts pass a string sys_id. The underlying Java class (SncTriggerSynchronizer.executeNow()) may simply not have a string overload.

2-minute test to confirm — run this in Background Scripts:

(function() {
    var grSched = new GlideRecord('discovery_schedule');
    grSched.setLimit(1);
    grSched.query();
    if (!grSched.next()) {
        gs.info('No discovery_schedule records found.');
        return;
    }
    var schedSysId = grSched.getUniqueValue();
    gs.info('Testing with STRING parameter...');
    try {
        new Discovery().discoverNow(schedSysId); // STRING
        gs.info('String worked — sandbox is the real issue.');
    } catch (e) {
        gs.info('String FAILED: ' + e.message);
        gs.info('Now test with GlideRecord in your ATF step.');
    }
})();

If the string fails here too — the root cause is parameter type, not sandbox. Fix your ATF step to query the schedule as a GlideRecord first, then pass it:

// ATF "Run Server Side Script" step — fixed
(function(outputs, steps, params, stepResult) {
    var grSched = new GlideRecord('discovery_schedule');
    grSched.get('YOUR_SCHEDULE_SYS_ID');
    var d = new Discovery();
    d.discoverNow(grSched); // GlideRecord, NOT string
    stepResult.setOutputMessage('Discovery triggered.');
    stepResult.setSuccess();
})(outputs, steps, params, stepResult);

If the string works in background scripts — then the sandbox restriction is real and the parameter type isn't the issue. In that case, ATF is the wrong tool for triggering Discovery on a schedule. Use a Scheduled Script Execution (sysauto_script) to run Discovery daily in unrestricted server context, and use ATF only to validate that Discovery ran (query discovery_status for today's record). Separate execution from validation — ATF is a test framework, not a scheduler.