fix(driver-k8s): add label selector to sandbox watch stream and list

[rhuss]

Summary

The K8s driver's watch_sandboxes() crashes with a file descriptor leak when non-gateway Sandbox resources (e.g. from SandboxWarmPool) exist in the namespace. This adds a label selector to filter at the API server level, and defensively skips unrecognized objects instead of propagating errors to the channel.

Related Issue

Fixes #2211

Changes

• Add openshell.ai/managed-by=openshell label selector to the watcher::Config in watch_sandboxes() so only gateway-managed Sandbox objects generate watch events
• Add the same label selector to ListParams in list_sandboxes() so only gateway-managed objects are returned
• Replace error propagation in all three watch event branches (Applied, Deleted, Restarted) with let ... else guards that debug! log the object name and continue, preventing crash loops from unrecognized objects
• Add 6 unit tests for sandbox_id_from_object and sandbox_from_object covering label extraction, name-prefix fallback, unknown object rejection, and the managed-by-without-sandbox-id edge case

Testing

• cargo clippy -p openshell-driver-kubernetes --all-targets -- -D warnings: Clean
• cargo test -p openshell-driver-kubernetes: 129 passed (123 existing + 6 new)
• Unit tests added/updated
• E2E tests added/updated (not applicable, label selector behavior requires a real K8s cluster with SandboxWarmPool CRDs)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable, no architectural change)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e-kubernetes applied, but pull-request/2223 is at {"messa while the PR head is 664fe92. A maintainer needs to comment /ok to test 664fe92d19cb4ba41643a214f792ea32fa27159f to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

[rhuss]

@drew looks like that the GitHub action in #2223 (comment) is a bit broken (at least that {"messa as a commit sha looks suspicious). Anything I can help with to fix this ?

[rhuss]

The garbled SHA display ({"messa) in the label hint comment above is a bug in the e2e-label-help workflow. Fix submitted in #2236.

[TaylorMutch]

/ok to test 664fe92

[TaylorMutch]

@rhuss please have a look at the CI failures; otherwise this LGTM.

[TaylorMutch]

The two Rust CI failures are formatting-only. I reproduced them locally on the PR head: cargo fmt --all produces three wrapping-only changes in crates/openshell-driver-kubernetes/src/driver.rs (the ListParams call, make_dynamic_object signature, and one labels.insert call).

After applying rustfmt locally:

• cargo fmt --all -- --check: passes
• cargo test -p openshell-driver-kubernetes: 129 passed

No logic changes are needed; running cargo fmt --all and committing the result should clear both Rust jobs.

[github-actions]

Label test:e2e applied for 664fe92. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.