fix(sandbox): stop setup-sandbox from pre-pulling the stale :latest sandbox image (#3983)

* fix(sandbox): stop setup-sandbox from pre-pulling the stale :latest image

scripts/setup-sandbox.sh's fallback (used whenever config.yaml has no
uncommented sandbox.image) pulled the volces mirror's :latest tag. We
confirmed in #3921/#3922 that this tag is frozen on the pre-1.9.3
all-in-one-sandbox digest (1.0.0.156), which lacks the /v1/bash/*
routes required-secrets skills need — so the one script whose entire
job is 'pre-pull a working sandbox image' was pre-pulling a known-broken
one. Pin the fallback to :1.11.0 instead.

Also update config.example.yaml's commented image: example and
'Recommended' line to the same version, so uncommenting the example
doesn't reproduce the same trap.

Out of scope on purpose: aio_sandbox_provider.py's DEFAULT_IMAGE
constant (the harness-level default for AioSandboxProvider itself)
is a separate, broader default-image decision already flagged to
maintainers in #3921 — this PR only fixes the pre-pull helper script.

Reported in #3914 (a real user deleted their stale local image, reran
make setup-sandbox, and got the same broken :latest image back).

* fix(sandbox): make setup-sandbox warn when the pull won't affect the runtime image

Self-review caught a real gap in the previous commit: AioSandboxProvider
resolves its image as `sandbox_config.image or DEFAULT_IMAGE`
(aio_sandbox_provider.py:214), and DEFAULT_IMAGE is deliberately left
untouched (still the frozen :latest, per #3921 — that's a maintainer
decision, not this PR's scope). So when config.yaml has no uncommented
sandbox.image, pre-pulling :1.11.0 alone creates a NEW inconsistency:
the script reports success pulling a modern image, but the sandbox
that actually starts still falls back to the broken :latest — silently
leaving the user's underlying required-secrets/bash.exec problem
unfixed, which is worse than the previous consistent-but-broken
behavior (pre-pull :latest, run :latest).

Make the unconfigured path loud about this instead of silent: print
the exact config.yaml snippet needed to make the pulled image actually
take effect.

config.example.yaml

@@ -1076,10 +1076,13 @@ sandbox:
 #
 #   # Optional: Container image to use (works with both Docker and Apple Container)
 #   # Default: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest
-#   # Recommended: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest (works on both x86_64 and arm64)
-#   # Custom images should extend the default image or implement the same AIO
-#   # sandbox HTTP API used by agent-sandbox. See backend/docs/CONFIGURATION.md.
-#   # image: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest
+#   # The mirror's `:latest` tag is frozen on an old pre-1.9.3 digest that lacks
+#   # the /v1/bash/* routes required-secrets skills need (see #3921/#3922), so
+#   # pin an explicit version instead — recommended: 1.11.0 (multi-arch, works
+#   # on both x86_64 and arm64). Custom images should extend the default image
+#   # or implement the same AIO sandbox HTTP API used by agent-sandbox. See
+#   # backend/docs/CONFIGURATION.md.
+#   # image: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:1.11.0
 #
 #   # Optional: Base port for sandbox containers (default: 8080)
 #   # port: 8080

scripts/setup-sandbox.sh

@@ -10,13 +10,19 @@ echo ""
 
 # Try to extract image from config.yaml (handles both commented and uncommented sandbox sections)
 IMAGE=""
+CONFIGURED=1
 if [ -f "config.yaml" ]; then
     # Look for uncommented image: field under the sandbox section
     IMAGE=$(grep -A 20 "^sandbox:" config.yaml 2>/dev/null | grep "^  image:" | awk '{print $2}' | head -1 || true)
 fi
 
 if [ -z "$IMAGE" ]; then
-    IMAGE="enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest"
+    # NOTE: not ":latest". The mirror's `:latest` tag is frozen on an old
+    # pre-1.9.3 digest that lacks the /v1/bash/* routes required-secrets
+    # skills need (see #3921/#3922) — pulling it here would defeat the whole
+    # point of this pre-pull helper. Keep this pinned to a version >= 1.9.3.
+    IMAGE="enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:1.11.0"
+    CONFIGURED=0
     echo "Using default image: $IMAGE"
 else
     echo "Using configured image: $IMAGE"
@@ -43,3 +49,15 @@ else
     echo "  Please install Docker: https://docs.docker.com/get-docker/"
     exit 1
 fi
+
+if [ "$CONFIGURED" -eq 0 ]; then
+    echo ""
+    echo "⚠ NOTE: pulling this image does not make the sandbox use it."
+    echo "  config.yaml has no uncommented 'sandbox.image', so AioSandboxProvider"
+    echo "  falls back to its own built-in default at runtime, which is still"
+    echo "  pinned to ':latest' (frozen on an old pre-1.9.3 digest — see #3921)."
+    echo "  To actually run on $IMAGE, add it explicitly:"
+    echo ""
+    echo "    sandbox:"
+    echo "      image: $IMAGE"
+fi