chore(deps): bump agent-sandbox to v1.0.8 (#25)

Update AGENT_SANDBOX_VERSION to v1.0.8 and the docs that quote the
control-plane pin (example prerequisites, architecture, versioning table,
minimal-single-tenant template comment, platform skill).

The v1.0.8 release adds only one CRD field, spec.failedPodPolicy
(Sandbox and SandboxTemplate, enum Retain|Recreate, default Retain), so
the existing manifests keep their behavior: Retain is the default and
neither the API version (v1beta1) nor any field we set changed. All five
custom resources still validate against the v1.0.8 CRD schemas.

Behavior changes in the controller itself (bounded MCP output, router
kustomization, creation-latency metric timing) do not affect the
platform because it uses neither the sandbox-router nor the MCP server.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

.dsh/skills/dsh-agent-sandbox-platform/SKILL.md

@@ -104,8 +104,9 @@ Verified from the upstream server:
   `shutdown_after_seconds` defaults to 300 s (`null` disables it).
 - **Output:** servers before v1.0.8 return unbounded `execute_command` output.
   v1.0.8 adds `max_output_chars` (128-300,000, default 30,000) and truncation
-  metadata. Never pass the new argument to an older server; redirect verbose
+  metadata. The repository pins v1.0.8 (`AGENT_SANDBOX_VERSION`), so the
-  output and read a file instead.
+  documented deployment is bounded; never pass the new argument to an older
+  server, and on one redirect verbose output and read a file instead.
 
 Deployment, connection matrix and DSH row:
 [MCP deployment](references/mcp-deployment.md). Limits and cleanup:

.dsh/skills/dsh-agent-sandbox-platform/references/mcp-server.md

@@ -74,6 +74,10 @@ DSH template.
 Never pass `max_output_chars` to a pre-v1.0.8 server. On older servers, redirect
 verbose output to a file and `download_file` it, or pipe through `tail`/`head`.
 
+The repository pins `AGENT_SANDBOX_VERSION=v1.0.8`, so the right-hand column is
+what the documented platform and a same-tag MCP build provide; keep the
+before-column for clusters still on v1.0.7.
+
 ## Safety and cleanup
 
 - No auth: anyone reaching `:8000` gets every tool and the service account's

docs/versioning.md

@@ -71,7 +71,7 @@ Values from [versions.env](../versions.env) at the current identity:
 | DSH ref | `dsh-v0.2.1-rc.3` | `DSH_VERSION` |
 | Repository revision | `r4` | `RELEASE_REVISION` |
 | pnpm | `11.28.5` | `PNPM_VERSION` |
-| agent-sandbox (CRDs) | `v1.0.7` | `AGENT_SANDBOX_VERSION`, used by the examples and CI dry-run |
+| agent-sandbox (CRDs) | `v1.0.8` | `AGENT_SANDBOX_VERSION`, used by the examples and CI dry-run |
 | Kubernetes Gateway API | `v1.2.1` | `GATEWAY_API_VERSION`, used by the SSO exposure variant |
 | oauth2-proxy | `quay.io/oauth2-proxy/oauth2-proxy:v7.15.5` | `OAUTH2_PROXY_IMAGE` |
 | Main image | `ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox` | `GHCR_IMAGE` |

examples/dsh-agents-as-a-service/README.md

@@ -83,7 +83,7 @@ What it demonstrates, feature by feature:
 - agent-sandbox with extensions installed:
 
   ```bash
-  VERSION=v1.0.7   # AGENT_SANDBOX_VERSION in versions.env
+  VERSION=v1.0.8   # AGENT_SANDBOX_VERSION in versions.env
   kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/$VERSION/sandbox-with-extensions.yaml
   kubectl -n agent-sandbox-system rollout status deployment --timeout=180s
   ```

examples/dsh-agents-as-a-service/docs/architecture.md

@@ -6,7 +6,7 @@ Kubernetes, and DSH Web fit together, and why the design looks the way it does.
 
 Scope: one Kubernetes namespace (`dsh-demo`), one shared DSH Web image, one gateway deployment,
 and one DSH Web pod + PVC per user. The cluster is assumed to run
-[agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox) v1.0.7 with the extensions
+[agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox) v1.0.8 with the extensions
 (`SandboxTemplate`, `SandboxWarmPool`, `SandboxClaim`).
 
 ## Container view

examples/minimal-single-tenant/manifests/sandbox-template.yaml

@@ -13,7 +13,7 @@
 #   - Optional: Secret dsh-provider-keys-extra with additional provider keys
 #     (OPENROUTER_API_KEY, GEMINI_API_KEY, NVIDIA_API_KEY, ...). It is
 #     referenced with `optional: true`, so it may be absent.
-# The agent-sandbox controller (v1.0.7, API v1beta1) must be installed.
+# The agent-sandbox controller (v1.0.8, API v1beta1) must be installed.
 apiVersion: extensions.agents.x-k8s.io/v1beta1
 kind: SandboxTemplate
 metadata:

versions.env

@@ -16,7 +16,7 @@ PNPM_VERSION=11.28.5
 RELEASE_REVISION=r4
 
 # Control-plane versions used by the examples and their manifests.
-AGENT_SANDBOX_VERSION=v1.0.7
+AGENT_SANDBOX_VERSION=v1.0.8
 GATEWAY_API_VERSION=v1.2.1
 OAUTH2_PROXY_IMAGE=quay.io/oauth2-proxy/oauth2-proxy:v7.15.5