[ACP on Cloud] Deploy: bump AGENT_SERVER_IMAGE to activate native session/load resume

[simonrosenberg]

Priority: P1 — follow-on to the native-resume stack. Part of #988.

Native session/load resume only activates when the deployed runtime/sandbox image bakes the /api/acp_session_blob routes (software-agent-sdk#3562). Until then the backend (#1248 / OpenHands#14709) degrades cleanly to bootstrap-prompt resume — the restore PUT 404s → Tier-A fallback — so this is an activation step, not a correctness blocker.

The pin

The runtime image is a constant in the OpenHands repo:
openhands/app_server/sandbox/sandbox_spec_service.py → AGENT_SERVER_IMAGE = 'ghcr.io/openhands/agent-server:1.26.0-python' (no blob routes). The deploy pipeline (deploy/.github/workflows/deploy.yaml) greps it at OPENHANDS_SHA and sets runtime.image.tag + the warm-runtime image.

Tasks

• Land software-agent-sdk#3562 → cut an SDK release / build a ghcr.io/openhands/agent-server:<tag> image that includes the blob routes.
• Bump AGENT_SERVER_IMAGE in sandbox_spec_service.py to that tag — on the same commit/branch that carries OpenHands#14709, so both halves resolve together at one OPENHANDS_SHA.
• Set OPENHANDS_SHA in deploy/.github/workflows/deploy.yaml to that commit.
• Flip prod only after the staging validation passes (tracked separately).

Done when

• A recycled cloud ACP conversation resumes via native session/load (same acp_session_id, no <<RESUMED CONVERSATION>> marker) on the deployed runtime image, Claude + Codex.

Depends on: software-agent-sdk#3562, #1248. Pairs with #1126.