feat: add Sandbox support to AgentCard controller

[cwiklik]

Summary

• Add conditional Sandbox Watches in SetupWithManager with SandboxCRDExists() guard
• Use mapWorkloadToAgentCard("agents.x-k8s.io/v1alpha1", "Sandbox") to enqueue AgentCard reconciliation on Sandbox changes
• Add RBAC marker for agents.x-k8s.io sandboxes

This ensures that changes to Sandbox workloads (label updates, scaling, etc.) trigger reconciliation of the associated AgentCard's status fields.

Closes #340

Test plan

• Deploy operator with Sandbox CRD installed → verify Sandbox watch is registered
• Update a Sandbox with kagenti.io/type: agent that has an AgentCard → verify AgentCard status is refreshed
• Deploy operator without Sandbox CRD → verify no error and watch is skipped

Assisted-By: Claude Code

[mrsabath]

Focused 10-line addition that mirrors the Sandbox watch pattern already shipping in clientregistration_controller.go (#338) and agentruntime_controller.go. Correctly uses EnqueueRequestsFromMapFunc (many-to-one via label mapping) rather than EnqueueRequestForObject (which is right for ClientRegistration but not here). All referenced helpers — SandboxCRDExists, sandboxGVK, mapWorkloadToAgentCard, workloadPredicates — already exist upstream. CRD-existence guard keeps this safe when Sandbox CRD is not installed.

Areas reviewed: Go controller code, RBAC markers, pattern parity with sibling controllers, linked issue #340.
Commits: 1, signed-off ✓
CI status: All 16 checks passing (including E2E, integration, unit, lint).

[mrsabath]

suggestion: No unit test asserts the Sandbox watch is registered when the CRD exists. This mirrors an already-tested pattern in clientregistration_controller.go (#338) and agentruntime_controller.go, so behavior is low-risk, but a small table-driven test in agentcard_controller_test.go verifying (a) watch is skipped when SandboxCRDExists returns false, and (b) a Sandbox label update triggers AgentCard reconcile, would close the loop. Could be a follow-up PR if you'd rather keep this one minimal.

[cwiklik]

Addressed in 2910322 — added two test cases in indexers_test.go verifying mapWorkloadToAgentCards correctly maps Sandbox objects:

1. Sandbox with agent label + matching AgentCard → returns reconcile request ✓
2. Sandbox without agent label → returns empty ✓

Re: SetupWithManager integration test (watch skipped when CRD absent): SandboxCRDExists is a plain function and the envtest env doesn't have the external Sandbox CRD, so that path can't be unit-tested without refactoring. No other controller in the repo tests watch registration either. Happy to track a follow-up if needed.