feat: report sandbox enforcement status

[shreyanshjain7174]

Summary

• Propagate common sandbox and workload UID labels across adapters.
• Report SandboxEnforced from observed child Pod RuntimeClass values.
• Surface strict admission denials and unsandboxed fallback as parent conditions.

Validation

• go build ./...
• make test-go
• make lint
• helm unittest charts
• helm lint charts

The local controller envtest suite remains blocked because the envtest etcd binary is absent.

[Copilot]

🟡 Changes recommended

The new Pod-cache label filtering is not reflected in a new sandbox observer test and the controller Pod listing should be tightened to match the cache selector.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds end to end sandbox enforcement reporting for AgentWorkload. It standardizes workload Pod labels so the controller can correlate child Pods and derive SandboxEnforced status from observed RuntimeClassName.

Changes:

• Centralize sandbox and workload correlation labels in pkg/governance, and propagate them into Argo and non-Argo runtimes.
• Add SandboxEnforced condition and SandboxExecutionUID, then update reconciliation to set the condition based on admission denials or observed child Pod RuntimeClassName.
• Add controller pod-cache filtering and RBAC needed to watch/list Pods efficiently.

File summaries

File	Description
pkg/runtime/labels.go	Switch runtime adapters to shared governance label helper.
pkg/runtime/argo_adapter.go	Propagate Argo workflow status message into normalized execution status.
pkg/runtime/adapter.go	Extend ExecutionStatus with a runtime status message field.
pkg/governance/labels.go	New shared label constants and PodLabels() helper for workload Pods.
pkg/governance/labels_test.go	Unit test for shared PodLabels() output.
pkg/argo/workflow.go	Stamp shared governance labels onto Argo workflow pod metadata.
pkg/argo/workflow_test.go	Assert shared labels are present in Argo workflow pod metadata.
internal/controller/sandbox_status.go	New sandbox observer that sets SandboxEnforced condition from admission or Pod observations.
internal/controller/sandbox_status_test.go	Unit tests for sandboxCondition() state transitions.
internal/controller/sandbox_observer_test.go	Observer integration tests using fake client and Pods.
internal/controller/agentworkload_controller.go	Wire sandbox observation into reconcile loop and add reconciler fields.
internal/admission/runtimeclass_injector.go	Use shared label constants and add denial prefix detection helper.
internal/admission/runtimeclass_injector_test.go	Add tests for IsSandboxDenial().
config/rbac/role.yaml	Grant manager Pod get/list/watch for sandbox observation and caching.
config/crd/bases/agentic.clawdlinux.org_agentworkloads.yaml	CRD regen for new status field.
cmd/main.go	Configure Pod cache selector, wire sandbox class and event recorder into reconciler.
api/v1alpha1/agentworkload_types.go	Add sandbox condition constants and SandboxExecutionUID status field.

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.