Post-1.0: Localhost seccomp on K8s, warm sandbox pool, server HPA

- K8sDriver.with_localhost_seccomp(profile): sandbox pods run under the
  STRICT allowlist instead of the runtime default. Proven live on kind:
  the harness installs the profile onto the node, a pod runs ordinary
  work as uid 10001, and unshare is kernel-denied inside the pod — the
  same probe the Docker suite uses, now passing on both targets
- Helm: sandbox.seccomp=localhost renders a DaemonSet that installs the
  chart-shipped profile into /var/lib/kubelet/seccomp on every node
  (ConfigMap + hostPath); ci/check-helm.sh enforces the chart copy stays
  byte-identical to images/seccomp/agent-profile.json and asserts the
  hardened render (DaemonSet + profile + HPA)
- server HPA (autoscaling/v2, CPU target) behind
  server.autoscaling.enabled
- SandboxManager.warm(n): a background warmer keeps n pre-provisioned
  sandboxes ready so an agent's first exec skips container startup;
  unhealthy pool entries are discarded, reuse never drains the pool,
  shutdown destroys assigned AND pooled. [sandbox] warm_pool config
  (default 0). Real-Docker test: prefill -> assign -> refill -> reuse ->
  clean shutdown

160 Rust tests + 4 live kind tests.

Co-Authored-By: Claude Fable 5 <[email protected]>

deploy/helm/teamclaw/templates/hpa.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.server.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: teamclaw-server
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: teamclaw-server
+  minReplicas: {{ .Values.server.autoscaling.min }}
+  maxReplicas: {{ .Values.server.autoscaling.max }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.server.autoscaling.targetCPU }}
+{{- end }}

deploy/helm/teamclaw/templates/seccomp-installer.yaml

@@ -0,0 +1,53 @@
+{{- if eq .Values.sandbox.seccomp "localhost" }}
+# Installs the strict allowlist seccomp profile onto every node so
+# sandbox pods can run with seccompProfile type Localhost. The profile is
+# the SAME file the Docker driver embeds (ci/check-helm.sh enforces the
+# copies stay identical).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: teamclaw-seccomp-profile
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+data:
+  teamclaw-agent-profile.json: |-
+{{ .Files.Get "files/agent-profile.json" | indent 4 }}
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: teamclaw-seccomp-installer
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: teamclaw-seccomp-installer
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: teamclaw-seccomp-installer
+    spec:
+      initContainers:
+        - name: install
+          image: busybox:1.36
+          command:
+            - sh
+            - -c
+            - cp /profile/teamclaw-agent-profile.json /host-seccomp/
+          volumeMounts:
+            - { name: profile, mountPath: /profile, readOnly: true }
+            - { name: host-seccomp, mountPath: /host-seccomp }
+      containers:
+        - name: hold
+          image: busybox:1.36
+          command: ["sleep", "infinity"]
+          resources:
+            requests: { cpu: 5m, memory: 8Mi }
+            limits: { cpu: 10m, memory: 16Mi }
+      volumes:
+        - name: profile
+          configMap: { name: teamclaw-seccomp-profile }
+        - name: host-seccomp
+          hostPath:
+            path: /var/lib/kubelet/seccomp
+            type: DirectoryOrCreate
+{{- end }}