fix: enable shareProcessNamespace for sandbox pods

[pdettori]

Summary

• Adds shareProcessNamespace: true to the sandbox pod spec in buildSandboxSpec()
• Enables the supervisor's proxy to resolve process identity for sandbox exec commands
• Without this, the proxy returns HTTP 403 on CONNECT because it cannot read /proc/<pid>/exe for processes spawned by the SSH relay

Context

When sandbox exec is used, the gateway relays the command to the supervisor's SSH daemon which spawns the process. The proxy's OPA evaluation path (resolve_tcp_peer_binary()) needs to walk /proc/*/fd/ to find which PID owns the socket, then read /proc/<pid>/exe for binary identity. Without a shared PID namespace, this fails silently and OPA denies the request (403).

With shareProcessNamespace: true, all processes share a single /proc view. The supervisor (PID 1) can see all spawned processes regardless of how they were created.

Risk: Low. The pod has a single user container (agent); sharing the PID namespace has no multi-container side effects.

Fixes: kagenti/kagenti#1830

Test plan

• Build new driver image with this change
• Deploy to HyperShift cluster with openshell stack
• Run test_T4_3_sandbox_egress_policy.py::TestOpenShellSandboxWithPolicy::test_openshell_with_policy__curl_github_returns_200
• Verify HTTP 200 (was 403 before)

Assisted-By: Claude Code