Post-1.0: Localhost seccomp on K8s, warm sandbox pool, server HPA

- K8sDriver.with_localhost_seccomp(profile): sandbox pods run under the
  STRICT allowlist instead of the runtime default. Proven live on kind:
  the harness installs the profile onto the node, a pod runs ordinary
  work as uid 10001, and unshare is kernel-denied inside the pod — the
  same probe the Docker suite uses, now passing on both targets
- Helm: sandbox.seccomp=localhost renders a DaemonSet that installs the
  chart-shipped profile into /var/lib/kubelet/seccomp on every node
  (ConfigMap + hostPath); ci/check-helm.sh enforces the chart copy stays
  byte-identical to images/seccomp/agent-profile.json and asserts the
  hardened render (DaemonSet + profile + HPA)
- server HPA (autoscaling/v2, CPU target) behind
  server.autoscaling.enabled
- SandboxManager.warm(n): a background warmer keeps n pre-provisioned
  sandboxes ready so an agent's first exec skips container startup;
  unhealthy pool entries are discarded, reuse never drains the pool,
  shutdown destroys assigned AND pooled. [sandbox] warm_pool config
  (default 0). Real-Docker test: prefill -> assign -> refill -> reuse ->
  clean shutdown

160 Rust tests + 4 live kind tests.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-config/src/lib.rs

@@ -144,6 +144,8 @@ pub struct SandboxConfig {
     pub browser_image: String,
     /// Disable to run without environment tools (shell.exec errors).
     pub enabled: bool,
+    /// Pre-provisioned sandboxes kept ready (0 = provision on demand).
+    pub warm_pool: usize,
 }
 
 impl Default for SandboxConfig {
@@ -152,6 +154,7 @@ impl Default for SandboxConfig {
             image: "teamclaw/agent-base:dev".into(),
             browser_image: "teamclaw/agent-browser:dev".into(),
             enabled: true,
+            warm_pool: 0,
         }
     }
 }