sdks/sandbox/go/v1.0.4

## What's New

### Breaking Changes

- The credential vault binding match no longer carries a `Ports` field. Port is now derived from the scheme (`https` → 443, `http` → 80), matching what the intercept layer (iptables/nft) actually redirects. If your Go code constructs credential vault bindings and sets `Match.Ports`, remove that field on upgrade — port selection is now implicit from the scheme. This removes a field that never provided real flexibility (only 80/443 were ever intercepted). #1189

### Features

- Added a client-side sandbox pool (OSEP-0005) for the Go SDK, enabling millisecond-level sandbox acquisition from pre-warmed idle instances. The new `SandboxPool` API (via `PoolBuilder`) provides a background reconcile loop with leader election, fill-deficit / shrink-excess management, exponential backoff on warmup failures, and near-expiry-aware idle reuse. `InMemoryPoolStateStore` covers single-process deployments; a separate optional `poolredis` sub-module (go-redis v9) provides `RedisPoolStateStore` with atomic Lua-script operations for distributed setups. The main SDK module stays on `go 1.20` with zero external dependencies — the pool is a fully opt-in, backward-compatible addition. Aligned with the Python and Kotlin pool implementations. #1198
- Added `run_once` and `withSession` isolation convenience helpers to the Go SDK. `sandbox.IsolationRunOnce(ctx, req, run, handlers)` wraps create → run → delete into a single call with guaranteed cleanup, and `sandbox.IsolationWithSession(ctx, req, fn)` scopes a multi-run isolated workflow with auto-delete on exit. Cleanup is best-effort so it never masks the original error. These build on the execd-backed isolation support added to the Go SDK (`isolated.go`, `sandbox_isolated.go`). #1008 #1222
- Added an LRU + TTL endpoint cache with in-flight request deduplication. The SDK now caches `(sandbox_id, port, use_server_proxy) → Endpoint` to avoid repeated resolution round-trips. It is enabled by default (TTL 600s, max size 1024) and tunable via `ConnectionConfig`; `Kill()` actively invalidates cached entries for the sandbox. #1133
- Sandbox lifecycle responses now surface `extensions`. The Go SDK response models expose `opensandbox.extensions.*` data returned by create/get/list so callers can read extension values round-tripped from the server. #1112
- Added the optional `resourceRequests` field to sandbox creation. Kubernetes-backed sandboxes can now set resource requests separately from limits (enabling Burstable QoS). Omitting the field preserves the existing behavior where requests equal limits. #1074

### Misc

- Updated the Go SDK README GitHub links to the new `opensandbox-group/OpenSandbox` org (Go module/import paths unchanged). #1197
- Bumped the Go Sandbox SDK version constant to `1.0.4` and added a regression test that locks the default User-Agent to the release version. #1248

### Contributors

- @GreenShadeZhang
- @Pangjiping
- @jianpingpei
- @jwx0925