feat(backend-kubernetes): add Pod options and identity policy

[tee8z]

The Kubernetes provider creates one bare Pod per agent with a fixed shape. Remote agent sessions need placement on dedicated workers, storage bounds, an absolute lifetime, and proof that the agent and owner keys are the approved pair. This PR adds two optional provider_config objects for that. Omitted options keep the original Pod shape and create-intent fingerprint.

provider_config field	Effect
pod_options.node_selector, pod_options.tolerations	Schedule only on matching, tainted nodes
pod_options.workspace_size_limit	emptyDir size limit for the workspace
pod_options.ephemeral_storage_request, pod_options.ephemeral_storage_limit	Reserve and bound writable storage and logs
pod_options.active_deadline_seconds	Positive absolute Pod lifetime, including startup
pod_options.setup_pending	Expose the server-assigned Pod UID to an owner setup gate
identity_policy.agent_pubkey, identity_policy.owner_pubkey	Approved key pair, checked before any cluster access

• Configured pod_options join the create-intent fingerprint, so a changed option is detected.
• identity::check refuses an owner key used as the agent, an agent key that differs from policy, a missing or invalid owner attestation, and a launch owner that differs from the verified owner.
• --check-identity runs the same checks locally. It returns only the public Pod name or a sanitized refusal.

Stack

Position 2 of 20 in the DEV-2884 Buzz stack. Base: #8. Next: #10.

Validation

Run on this layer's commit, for buzz-backend-kubernetes and buzz-acp:

• cargo fmt --check: pass.
• cargo clippy --all-targets -- -D warnings: pass.
• cargo test -p buzz-backend-kubernetes: 171 passed, 0 failed.
• cargo test -p buzz-acp: 1,078 passed, 3 ignored, 0 failed.

Limits

• No live cluster is exercised; scheduling, tolerations, and storage eviction are untested here.
• Buzz AGENTS.md requires a human to test the change before it leaves draft.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}