API-managed pods (iron-proxy, tool-server, workflow-run) can't set resource requests/limits

[pkobielak]

Summary

Several pods the API creates at runtime have no way to set Kubernetes resource requests/limits. The chart exposes resources for api, postgres, slackbot, tokenBroker, repoCache, ironControl, and the sandbox container, but not for the iron-proxy Pods (the API self-proxy and every per-sandbox proxy), the tool-server sidecar, or the workflow-run pod. The container specs in services/api/api/sandbox/kubernetes.py are hardcoded with no resources field and no env knob, so these pods run with no scheduler reservation and no OOM/throttle ceiling (the workflow-run pod only incidentally inherits the sandbox sizing).

Steps to reproduce

1. Deploy Centaur with toolServer.enabled=true and the kubernetes sandbox backend.
2. Inspect container resources, e.g. kubectl get pod <pod> -o jsonpath='{.spec.containers[*].resources}':
   • centaur-api-proxy-* and per-sandbox *-proxy-* (container iron-proxy) → {}
   • sandbox tool-server sidecar → {}
   • workflow-run pods → inherit the sandbox sizing, not independently configurable
3. Contrast the sandbox container, which is sized via sandbox.resources → KUBERNETES_SANDBOX_* env → _pod_resources().

Root cause

_build_proxy_pod_spec, _build_tool_server_container, and _build_workflow_run_pod_spec build their containers without a configurable resources, and the chart's ironProxy/toolServer have no resources keys. There is no env knob analogous to the sandbox's _pod_resources() for these containers, so they cannot be sized and the workflow-run pod can only inherit the sandbox's values.

Expected outcome

• Each API-managed pod — the API self-proxy, every per-sandbox proxy, the tool-server sidecar, and the workflow-run pod — can be sized independently via chart values.
• Leaving the values unset preserves current behavior: the proxies and tool-server stay unconstrained, and the workflow-run pod keeps its prior sandbox-equivalent sizing.
• Partial specs work (e.g. memory request==limit, no CPU request).