chore(deps): bump agent-sandbox to v1.0.8 (#25)

Update AGENT_SANDBOX_VERSION to v1.0.8 and the docs that quote the
control-plane pin (example prerequisites, architecture, versioning table,
minimal-single-tenant template comment, platform skill).

The v1.0.8 release adds only one CRD field, spec.failedPodPolicy
(Sandbox and SandboxTemplate, enum Retain|Recreate, default Retain), so
the existing manifests keep their behavior: Retain is the default and
neither the API version (v1beta1) nor any field we set changed. All five
custom resources still validate against the v1.0.8 CRD schemas.

Behavior changes in the controller itself (bounded MCP output, router
kustomization, creation-latency metric timing) do not affect the
platform because it uses neither the sandbox-router nor the MCP server.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

.dsh/skills/dsh-agent-sandbox-platform/references/mcp-server.md

@@ -74,6 +74,10 @@ DSH template.
 Never pass `max_output_chars` to a pre-v1.0.8 server. On older servers, redirect
 verbose output to a file and `download_file` it, or pipe through `tail`/`head`.
 
+The repository pins `AGENT_SANDBOX_VERSION=v1.0.8`, so the right-hand column is
+what the documented platform and a same-tag MCP build provide; keep the
+before-column for clusters still on v1.0.7.
+
 ## Safety and cleanup
 
 - No auth: anyone reaching `:8000` gets every tool and the service account's