build(deps-dev): bump @typescript-eslint/parser from 8.67.0 to 8.66.0

build(deps-dev): update eslint requirement from ^10.8.0 to ^10.8.1

Co-authored-by: David Rojas <lempira@users.noreply.github.com>

The app_box_* opcodes can operate on another application's boxes, but
the AVM chapter never said this requires the accessed application's
opt-in. Add a paragraph pointing at the ForeignBoxReads and
FamilyBoxAccess parameters and the family reentrancy rule, which are
specified in the ledger's Applications chapter.

Regenerated Appendix A and the auto-included opcode tables from
algorand/go-algorand#6690, which audits the AVM opcode documentation.
Notable box changes: the short descriptions now state the 64-byte name
limit, and the shared availability/authorization/reentrancy prose no
longer repeats under every box opcode, deferring to the normative
sections of this spec instead.

The availability, authorization, and reentrancy rules were repeated in
the extra text of all 18 box opcodes. Shared semantics belong in prose
outside the individual opcodes, as the byte math opcodes already do:
every sentence is normatively covered in the specs repo (box name
length, availability, the ClearState ban, the box-access flags, and
the family reentrancy rule), and the AVM chapter's Box Access section
gains a paragraph pointing at the authorization rules.

Keep only op-specific extra text: the zero-fill note on the creates,
the 4,096-byte advice on get/put, and the constant-length note on
splice. The improved short descriptions, including the 64-byte name
limit, are unchanged.