Adopt agent-sandbox CRD for per-tenant kernel-isolated workspaces

[snese]

Summary

Adopt the kubernetes-sigs/agent-sandbox model (as packaged in awslabs/ai-on-eks) to give each tenant a declarative, lifecycle-managed, kernel-isolatable workspace. Today tenants are plain Deployments isolated only at the namespace + NetworkPolicy level. This migrates the per-tenant workload to the Sandbox CRD model and adds a gVisor runtime tier as a follow-up.

Why

• The Sandbox CRD is purpose-built for "a long-running, stateful, singleton container with a stable identity" — exactly the per-tenant persistent workspace model used here.
• Its target architecture includes hibernation + resume-on-incoming-connection (native scale-to-zero for the agent tier). This is not yet available on the pinned v0.4.5 and lands incrementally — tracked upstream in Auto Suspend/Resume kubernetes-sigs/agent-sandbox#968 (see Scope below).
• gVisor is delivered as a SandboxTemplate runtimeClassName field, not a standalone layer — so adopting the Sandbox control plane first is the architecturally correct order.
• Built on AWS-native + OSS SIG primitives.

Scope (phased)

• PR chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 #1 — Sandbox control plane + tenant migration (runc): deploy the agent-sandbox controller + CRDs as an ArgoCD-managed addon; add a per-tenant runc SandboxTemplate; migrate the per-tenant workload from Deployment to SandboxClaim; route the Gateway HTTPRoute to the controller-owned Service. Runtime stays runc. The pinned controller (v0.4.5 / v1alpha1) has no connection-triggered resume, so this PR runs always-on; scale-to-zero is deferred (see PR chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 #1.5). Design doc docs/agent-sandbox.md (included in this PR).
• PR chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 #1.5 — scale-to-zero (hibernation + data-path router): add the sandbox-router and idle hibernation once the upstream resume mechanism is available. Gated on upstream Auto Suspend/Resume (Auto Suspend/Resume kubernetes-sigs/agent-sandbox#968).
• PR chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 #2 — gVisor runtime tier: (merged in feat(gvisor): selectable gVisor runtime tier for tenant sandboxes #9) add a gvisor RuntimeClass, a gVisor-capable ARM64 Karpenter NodePool (AL2023 + runsc shim via user-data), a gvisor SandboxTemplate, and flip the tenant claim to the gVisor template (a single field).

Verified design notes

• gVisor supports ARM64, so the all-Graviton (Graviton/arm64) cluster needs no x86 migration.
• On v0.4.5 v1alpha1, SandboxClaim.spec.sandboxTemplateRef links directly to the SandboxTemplate; the controller deletes the pod at Replicas==0 (no native wake), which is why scale-to-zero is split into PR chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 #1.5 and tracked against the upstream auto suspend/resume work.

[snese]

PR #1 (control plane + runc tenant migration, always-on) merged in #6. Also fixed CI startup (#7) so the pipeline now actually gates PRs. Next: PR #2 (gVisor runtime tier). PR #1.5 (scale-to-zero) remains gated on upstream kubernetes-sigs/agent-sandbox#968.

[snese]

Roadmap update after #6 merged and the runtime-tier review:

• fix: unblock fresh deploys (AWS CDK CLI pin + auth-ui asset upload) #10 (merged) extracts the two fresh-deploy fixes out of feat(gvisor): selectable gVisor runtime tier for tenant sandboxes #9 — main was broken for clean deploys without them (AWS CDK CLI schema mismatch + auth-ui asset upload timeout).
• feat(gvisor): selectable gVisor runtime tier for tenant sandboxes #9 (gVisor tier) rescoped and un-WIPed: adds x86_64 fallback pools (arm64/AWS Graviton stays preferred), RuntimeClass pod overhead accounting, and — the important structural piece — a runtime tier extension contract in ADR-0007 plus scripts/conformance-runtime-tier.sh. Any future runtime tier (e.g. microVM-class isolation as upstream/Amazon EKS options mature) plugs into four seams: RuntimeClass, NodePool/NodeClass, the sandbox.runtimeClassName value, and the conformance gate. Tier policy: at most two tiers at a time; a new hardened tier replaces the previous one.
• New: feat(security): enforce per-tenant NetworkPolicy via Amazon VPC CNI (ADR-0008) #11 NetworkPolicy enforcement — the per-tenant NetworkPolicy was stored but not enforced (the Amazon VPC CNI network policy agent is off by default on Amazon EKS). ADR-0008 covers the decision, the agent-behavior impact, and the residual risk. For agent workloads this is the highest isolation-value-per-complexity layer; no runtime tier substitutes for egress control.
• Still gated on upstream: scale-to-zero (PR chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 #1.5) remains blocked on Auto Suspend/Resume kubernetes-sigs/agent-sandbox#968 (Auto Suspend/Resume). Check-back: 2026-10.

[snese]

PR #2 (gVisor runtime tier) merged in #9, with review fixes (pinned + checksum-verified runsc release, systrap platform, authenticated conformance gates, Karpenter-visible maxPods) and live E2E evidence on both arm64 and x86_64. NetworkPolicy enforcement merged in #11.

Remaining scope on this umbrella: PR #1.5 (scale-to-zero) — still gated on upstream kubernetes-sigs/agent-sandbox#968 (Auto Suspend/Resume). Check-back: 2026-10.