feat(helm): Add AgentSandbox as an opt-out subchart dependency

[TaylorMutch]

Problem Statement

kubernetes-sigs/agent-sandbox is a dependency of the OpenShell Kubernetes Driver. Today it must be installed separately, which adds friction for new cluster deployments and increases the risk of version mismatches.

Proposed Design

Add agent-sandbox as an opt-out subchart in deploy/helm/openshell/Chart.yaml:

dependencies:
  - name: agent-sandbox
    repository: <upstream chart repo>
    version: <version>
    condition: agent-sandbox.enabled

Default values.yaml enables the subchart:

agent-sandbox:
  enabled: true

Multi-tenant or cluster-managed deployments opt out with a single override:

agent-sandbox:
  enabled: false

Alternatives Considered

Opt-in instead of opt-out: Requiring users to explicitly enable the subchart is safer for multi-tenant clusters, but increases friction for the common single-tenant case. Opt-out was chosen to keep the default experience zero-config.

Agent Investigation

N/A — requirement is clear and scoped to the Helm chart.

Checklist

• I've reviewed existing issues and the architecture docs
• This is a design proposal, not a "please build this" request