Upgrade agent-sandbox v0.4.5 → v0.5.2+ (v1beta1 migration)

[v0.5.0](https://github.com/kubernetes-sigs/agent-sandbox/releases/tag/v0.5.0)
(2026-06-24) graduated the APIs to `v1beta1`; per the release notes, "v1alpha1
APIs are now deprecated". This sample currently teaches a deprecated API.
Upgrade is NOT a version bump:

- [ ] `SandboxClaim.spec.templateRef` → `spec.warmpoolRef`; for the
no-prewarmed-capacity path, reference a `SandboxWarmPool` with `replicas: 0`
(supersedes the design recorded in ADR-0002 — new ADR + index update)
- [ ] `spec.replicas` → `spec.operatingMode: Running | Suspended`
- [ ] Re-verify NetworkPolicy interactions: v0.5.0's controller-managed policy
scopes sandbox-router ingress to `agent-sandbox-system`, and this cluster now
enforces NetworkPolicy (#11) — prove tenant HTTPRoute → controller-owned
Service → sandbox traffic end to end under enforcement
- [ ] `scripts/conformance-runtime-tier.sh` both tiers post-upgrade
- [ ] Rollback plan: restore prior chart + CRDs and re-validate an existing
tenant route before declaring rollback complete

**Timing:** do not begin until v0.5.2 is released (upstream advisory: v0.5.0/
v0.5.1 carry a status-wiping race for warm-started claims; fix scheduled for
the v0.5.2 release, expected 2026-07-16) — re-check its release notes before
starting.

Part of #5.

Wait for v0.5.2, then re-check its release notes before inspecting the sample's SandboxClaim, SandboxWarmPool, chart and CRD references. Read ADR-0002 and update its replacement and index, then run scripts/conformance-runtime-tier.sh for both tiers. Done means both tiers pass, tenant HTTPRoute traffic works under NetworkPolicy enforcement, and rollback restores the chart and CRDs while re-validating an existing route.

Written by the indexing model from the issue text.