AgentCardNetworkPolicy controller does not watch Sandbox workloads

[cwiklik]

Summary

The AgentCardNetworkPolicyReconciler watches Deployment and StatefulSet to create NetworkPolicies for workloads referenced by AgentCards. It does not watch Sandbox (agents.x-k8s.io/v1alpha1), so Sandbox-deployed agents don't get NetworkPolicies created.

Impact

Depending on the cluster's default network policy:

• Default deny: Sandbox agents are unreachable — no ingress policy allows traffic to them
• Default allow: Sandbox agents have no network segmentation — less secure than Deployment/StatefulSet agents

Required Changes

1. Add a conditional Watches call in SetupWithManager using SandboxCRDExists() guard
2. Use unstructured object with sandboxGVK
3. Map Sandbox events to AgentCard via mapWorkloadToAgentCard("agents.x-k8s.io/v1alpha1", "Sandbox")
4. Add RBAC marker for agents.x-k8s.io sandboxes

Reference

• PR fix: watch Sandbox resources in ClientRegistration controller #338 (ClientRegistration Sandbox support) for the pattern
• agentruntime_controller.go for the canonical Sandbox watch setup
• Epic #1155 (Sandbox workload support)

Acceptance Criteria

• NetworkPolicy created for Sandbox workloads referenced by AgentCards
• Existing Deployment/StatefulSet behavior unchanged
• Controller does not crash when Sandbox CRD is not installed