agent-sandbox-deploylisted

# Agent Sandbox Deploy Stand up the experimental [`kubernetes-sigs/agent-sandbox`](https://github.com/kubernetes-sigs/agent-sandbox) workspace provider against an Orka controller on a local kind cluster. Today, validate install/config, the direct workspace-adapter lifecycle, and the plain harness-backed agent path; treat a `type: agent` Task with `spec.execution.workspace` as an expected-failure check for the documented harness gate until workspace-backed agent Tasks are wired. This skill is for **local/kind evaluation and validation**, not production. Orka does not install or manage upstream agent-sandbox CRDs, the router, templates, or warm pools in production — install and operate those separately. See `website/docs/concepts/agent-sandbox.md` for the full design and the production controller flags. ## What this skill orchestrates (do not retype) The repeatable standup already lives in `hack/demos/cluster/install-agent-sandbox.sh`. **Drive that script in place; do not copy it into the skill.** It pins the agent-sandbox version (`ORKA_AGENT_SANDBOX_VERSION`, default `v0.4.6`) and owns the gotchas (kind registry addressing, the SDK sandbox-router build from the Go module cache, the controller flag patch). Re-pin by overriding the env var, not by editing a copy. What the script does: 1. **Base layer (always):** installs agent-sandbox CRDs + controllers, applies the `orka-live-template` SandboxTemplate, and patches the existing Orka controller Deployment with `--age