feat: add Sandbox support to AgentCard controller

The AgentCard controller watches Deployment and StatefulSet to trigger
reconciliation when workloads change. It did not watch Sandbox, so
AgentCard status wouldn't react to Sandbox lifecycle events.

Add conditional Watches for Sandbox via SandboxCRDExists guard, using
the existing mapWorkloadToAgentCard handler.

Fixes: #340

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: cwiklik <cwiklikj@gmail.com>

Author: cwiklik

kagenti-operator/internal/controller/agentcard_controller.go

@@ -140,6 +140,7 @@ type AgentCardReconciler struct {
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch
+// +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes,verbs=get;list;watch
 
 func (r *AgentCardReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	agentCardLogger.V(1).Info("Reconciling AgentCard", "namespacedName", req.NamespacedName)
@@ -1282,6 +1283,16 @@ func (r *AgentCardReconciler) SetupWithManager(mgr ctrl.Manager) error {
 			builder.WithPredicates(workloadPredicates),
 		)
 
+	if SandboxCRDExists(mgr.GetConfig()) {
+		sandboxObj := &unstructured.Unstructured{}
+		sandboxObj.SetGroupVersionKind(sandboxGVK)
+		controllerBuilder = controllerBuilder.Watches(
+			sandboxObj,
+			handler.EnqueueRequestsFromMapFunc(r.mapWorkloadToAgentCard("agents.x-k8s.io/v1alpha1", "Sandbox")),
+			builder.WithPredicates(workloadPredicates),
+		)
+	}
+
 	return controllerBuilder.
 		Named("AgentCard").
 		Complete(r)