Add a Kubernetes sandbox backend

[eseiker]

Adds a simple Kubernetes sandbox backend using kubectl for self-hosted QM, reusing the local sandbox image, HTTP execution daemon, and existing file, backup, and process-session helpers.

• Manage sandbox Pods and PVCs through kubectl, passing resource manifests via stdin.
• Support an optional RuntimeClass, including operator-configured runtimes such as gVisor or Kata.
• Preserve resident PVCs when parking; use ephemeral storage for scratch sandboxes.
• Add opt-in Helm configuration through kubernetesSandbox.enabled, with scoped RBAC and core configuration.

Includes a short ADR describing the approach and tradeoffs. Validation covers sandbox lifecycle, failure handling, configuration, routing, and Helm rendering. Type checks, lint, and independent review pass. Live Kubernetes validation is still outstanding.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}