0.3.7: docs say APIs are free, and stop pinning v0.1.17

[liyangbing]

Two problems in the docs.

1. They were stale in a way that hurt installs. Every README and llms-install.md told people to run a pinned v0.1.17 tarball URL — 15 releases old, no upload, no agent self-setup — and stated that "the npm latest tag currently serves v0.1.14 while trusted publishing is being enabled", which is no longer true now that npm serves 0.3.6. 102 stale references across 11 files are gone: install commands are npx -y @sandbaseai/cli@latest, the hard-coded 0.1.17 SHA-256 is replaced by a pin-and-verify snippet that reads the current version, and the MCP Registry links no longer point at /versions/0.1.17.

2. They said everything costs money. Verified against the live catalog: every sampled type=api tool is base_price: 0 (28 tools across 13 queries), while models stay paid (DeepSeek $0.3/$1.2 per 1M tokens, video $1–1.8/call). So:

• A What It Costs table in all 8 READMEs: data APIs free, discovery/inspect/status/balance/upload free, models paid.
• Skill 0.3.7 §6 leads with price: base_price: 0 means free, and an agent must not ask the user to approve a cost for a 0-priced call. That was the real bug — the Skill said "paid per call", so agents gated free API calls behind cost confirmations.
• The wording is self-correcting on purpose: it points at inspect as the source of truth instead of hard-coding a promotion, so a Skill cached on someone's machine cannot go stale if pricing changes.

Also: every README now leads with set up https://www.sandbase.ai/SKILL.md, which was missing from all of them, and the MCP tools table gains sandbase_run_cancel.

Tests: 180, 179 pass, 1 skip.