docker/cagent bakes kubectl and the AWS CLI into its sandbox templates and fixed a production data race.

v1.138.1, September 11, puts both CLIs in the sbx-templates image so sandboxed agents get them without a manual install, and adds pkg/config/httprelay and pkg/modelsgateway/relay for agent config fetching and model-API forwarding. On correctness it fixes a race in App where ReplaceSession wrote a.session from the update loop while background goroutines started by App.Start read it concurrently, plus a bug dropping the starred flag on fork because AddSession omitted the column. CI now runs go test -race -shuffle=on on every push to main, which is how they'll find the next one.