chore(k8s): use upstream agent-sandbox manifests in CI/e2e, install extensions

Drop the vendored deploy/kube/manifests/agent-sandbox.yaml. CI and e2e
scripts now apply manifest.yaml + extensions.yaml directly from
github.com/kubernetes-sigs/agent-sandbox releases, pinned via
AGENT_SANDBOX_VERSION env (default v0.4.6, overridable) so internal
runs stay reproducible.

Public docs and the helm chart README continue to reference
/releases/latest/download/ — no OpenShell/agent-sandbox support matrix
exists yet (see #1649).

Adds an air-gap note in docs/kubernetes/setup.mdx enumerating the
manifests and images operators need to mirror to an internal registry.

Signed-off-by: Roshni Malani <rmalani@nvidia.com>

Author: rmalani-nv

.agents/skills/helm-dev-environment/SKILL.md

@@ -26,9 +26,11 @@ mise run helm:k3s:create
 ```
 
 Creates a k3d cluster and merges its kubeconfig into the worktree-local `kubeconfig` file.
-Also applies base manifests (`deploy/kube/manifests/agent-sandbox.yaml`) and preloads the
-default community sandbox image into k3d so the first sandbox create does not wait on a
-large registry pull. Traefik is disabled at cluster creation time.
+Also applies the upstream agent-sandbox CRDs/controller and extensions (pinned via
+`AGENT_SANDBOX_VERSION` in `tasks/scripts/helm-k3s-local.sh`, fetched from
+`github.com/kubernetes-sigs/agent-sandbox` releases) and preloads the default community
+sandbox image into k3d so the first sandbox create does not wait on a large registry pull.
+Traefik is disabled at cluster creation time.
 
 **Multi-worktree support:** the cluster name is derived from the last component of the
 current git branch (e.g. branch `kube-support/local-dev/tmutch` → cluster

deploy/helm/openshell/README.md

@@ -15,6 +15,7 @@ The Kubernetes Agent Sandbox CRDs and controller must be installed on the cluste
 
 ```shell
 kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/manifest.yaml
+kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/extensions.yaml
 ```
 
 ## Install on Kubernetes

deploy/helm/openshell/README.md.gotmpl

@@ -15,6 +15,7 @@ The Kubernetes Agent Sandbox CRDs and controller must be installed on the cluste
 
 ```shell
 kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/manifest.yaml
+kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/extensions.yaml
 ```
 
 ## Install on Kubernetes