AgentCardSync controller does not watch Sandbox workloads

[cwiklik]

Summary

The AgentCardSyncReconciler watches Deployment and StatefulSet to auto-create AgentCard CRs for workloads with kagenti.io/type: agent + protocol labels. It does not watch Sandbox (agents.x-k8s.io/v1alpha1), so Sandbox-deployed agents never get an AgentCard auto-created.

Impact

With featureFlags.agentSandbox: true (intended default), Sandbox is the recommended workload type in the UI. Agents deployed as Sandbox are not discoverable via A2A protocol because no AgentCard exists for them.

Required Changes

1. Add a third controller registration in SetupWithManager (similar to the Deployment/StatefulSet adapter pattern) using SandboxCRDExists() guard
2. Add a ReconcileSandbox method that extracts labels from spec.podTemplate.metadata.labels via unstructured access
3. Pass the Sandbox GVK to ensureAgentCard
4. Add RBAC marker for agents.x-k8s.io sandboxes

Reference

• PR fix: watch Sandbox resources in ClientRegistration controller #338 (ClientRegistration Sandbox support) for the unstructured + SandboxCRDExists pattern
• agentruntime_controller.go for the canonical Sandbox watch setup
• Epic #1155 (Sandbox workload support)

Acceptance Criteria

• Sandbox workload with kagenti.io/type: agent + protocol labels gets AgentCard auto-created
• Existing Deployment/StatefulSet behavior unchanged
• Controller does not crash when Sandbox CRD is not installed