feat: discover Sandboxes and enforce routing and traffic policies

[Kuromesi]

Add Sandbox discovery, traffic metadata, egress routing, and native TrafficPolicy enforcement to ztunnel. With ENABLE_SANDBOX_MANAGER=true, the existing ADS stream watches Sandbox resources independently of Workload on-demand mode. An empty pool does not block proxy readiness.

• Decode agentio.sandbox and agentio.security resources into validated, immutable Sandbox snapshots indexed by Workload UID. Invalid updates retain the last accepted snapshot and binding.
• Select the Workload's first attested Sandbox and reuse the common egress-routing matcher. Carry its ID in the outer HBONE CONNECT x-agentio-sandbox-id header, and partition HBONE pools by that optional ID. Token lookup remains independent of Sandbox IDs.
• Enforce native ingress and egress TrafficPolicies through TCP authorization and the existing nftables/iptables firewall backends. Policies follow control-plane order, with lower numeric priority first. Native policies replace legacy Agentio Workload TrafficPolicies for a selected Sandbox; without a Sandbox, the existing Workload path applies. TCP ALLOW completes authorization, while ordinary Istio AuthorizationPolicy remains the fallback when the native direction is absent.
• Notify existing policy watchers on accepted Sandbox updates and removals, rechecking tracked TCP connections and rebuilding non-TCP rules. Lifecycle fields alone do not drain connections or remove local bindings.

Discovery remains asynchronous: this does not add a startup enforcement barrier. Selection currently uses the first Sandbox per Workload; per-connection attribution among simultaneous Sandboxes in one Pod is future work. Existing non-TCP conntrack entries are not flushed by policy updates.

Control-plane compatibility: the server must publish type.googleapis.com/agentio.sandbox.Sandbox, understand initial empty wildcard subscriptions, and deliver policies in ascending priority order. Agentio PR #73 aligns ordering, subscription, and Pod-binding behavior; matching protobuf package/type URLs are also required.

Validation:

• cargo fmt --check and git diff --check passed.
• cargo test --locked --offline --lib sandbox -- --test-threads=2: 40 tests passed, covering discovery/reconnect, validation, routing, metadata, pool isolation, native policy matching, firewall conversion, and TCP rechecks.
• cargo clippy --locked --offline --lib --bins completed successfully with warnings.
• Repository copyright validation passed against the pinned upstream baseline.
• Dedicated-sidecar Kind validation covered HBONE identity, application-header spoofing, TCP ingress/egress, priority updates, CIDR/ports, existing TCP connection closure, UDP on nftables and iptables, and restart loading. That run used a temporary explicit wildcard subscription and a control-plane protobuf naming adaptation. The final empty-subscription path is covered by the local ADS tests; it has not yet been redeployed to Kind. EPE/SNI policy synchronization and real Kruise pool lifecycle were outside that run.

[kruise-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from kuromesi by writing /assign @kuromesi in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment