Add a GCP GKE Agent Sandbox runtime adapter - #367

Updated the GKE adapter after validating against a live managed Agent Sandbox CRD. The served v1alpha1 SandboxClaim schema requires spec.sandboxTemplateRef; the equivalent claim passed server-side dry-run. This replaces the rejected warm-pool-specific claim fields while preserving the separately managed warm pool that references the same template. Local full tests (928), typecheck, and lint pass.

Live GKE execution exposed a non-root workspace issue after claim provisioning was fixed: managed Agent Sandbox mounts /home/agent writable to uid/gid 1000, but preserves the image-baked /home/agent/workspace as root-owned 0755. Updated the GKE adapter to create /home/agent/qm-workspace at runtime, avoiding an init container or privilege escalation. Manual live write probe and focused adapter tests pass.

Thanks for this, @ssalih1993 — and sorry for the slow response.

We're closing this PR. Per CONTRIBUTING.md, since coding agents write most of the underlying code now, we'd rather receive feature ideas as a short human-written note in adrs/ — informal is great, just the idea in your own words — and bugs as a plain issue. If we're aligned we're happy to burn our own tokens on the implementation, and we'll credit you as co-author.

We don't want your idea to get lost, so we've captured it in #735 to triage on our side. Please feel free to open an adrs/ note if you feel strongly about the approach. Appreciate you engaging with the repo!