fix(botfights): 1.2.8 — CSP img-src (broken profile pictures), AI-answer discoverability

Bumps to botfights:1.2.8, which carries: the CSP img-src fix (nostr profile
pictures come from user-supplied kind:0 metadata URLs on arbitrary domains
— img-src was locked to 'self'/data:/blob: with no https:, so every
external profile picture rendered as a broken image), and discoverability
fixes for the new AI-answer feature (poll mode is now the default
connection mode, matching BOTFIGHTS.md's own documented default, and the
AI-answer section is expanded by default instead of collapsed behind an
extra click).

Canonical arena on VPS2 already rolled to 1.2.8 directly (docker compose
pull/up) ahead of this catalog publish, since it's a separate deployment
from the archy-catalog-driven per-node install path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/image-versions.sh

@@ -90,7 +90,7 @@ FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
 ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
 
 # Community / Gaming
-BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.7"
+BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.8"
 
 # IndeedHub stack
 INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"