fix: recover from warm pool pod deletion instead of permanent error loop

[vamsi-resolve]

Summary

• Cherry-picks upstream kubernetes-sigs/agent-sandbox#521 — clears stale pod-name annotation when adopted warm pool pod is deleted, allowing controller to create a replacement pod instead of entering a permanent reconcile error loop
• Cherry-picks upstream kubernetes-sigs/agent-sandbox#469 — ensures pod-name annotation is correct during warm pool adoption before sandbox can be observed Ready (race condition fix)
• Updates test to match new recovery behavior

Context

Investigation of a reclaw supervisor timeout revealed that when a warm pool pod dies (node failure, drain, eviction), the sandbox controller returned a hard error because the agents.x-k8s.io/pod-name annotation pointed to a non-existent pod. The Sandbox CR entered a permanent reconcile error loop — no replacement pod was ever created.

Fix 1 (kubernetes-sigs#521): Clear stale annotation

When the annotated pod is not found (404), the controller now clears the stale annotation and falls through to the pod creation path. The existing PVC (owned by Sandbox CR, not the pod) is remounted by the replacement pod, preserving workspace data.

Fix 2 (kubernetes-sigs#469): Correct annotation during adoption

During warm pool adoption, the claim controller now ensures the pod-name annotation matches adopted.Name before the atomic r.Update call that transfers ownership. This prevents stale annotations from being set in the first place.

Test plan

• TestReconcilePod — all 13 cases pass, including new "clears stale annotation and creates replacement pod" case
• extensions/controllers — all tests pass
• Deploy to dev0 and verify warm pool adoption works correctly
• Simulate pod deletion on an adopted sandbox and confirm replacement pod is created

🤖 Generated with Claude Code