feat(controller): add persistent sandbox workspaces

[掌柜的 (nikawang)]

Summary

• add opt-in per-sandbox PVC storage for /sandbox, including dynamic claims, explicit existing-claim recovery, Retain/Delete lifecycle safety, and StorageReady status
• add declarative OpenClaw workspace bootstrap for AGENTS.md, SOUL.md, HEARTBEAT.md, TOOLS.md, and USER.md, with atomic writes, digest provenance, symlink defenses, and init-container credential isolation
• expose storage/bootstrap through kars add, Helm CRD/RBAC, generated CRD validation, lifecycle docs, and security guidance while preserving emptyDir as the backward-compatible default

Related Issues

None.

Type of Change

• Bug fix
• New feature
• Security hardening
• Documentation
• CI/CD
• Refactor

Checklist

• Code compiles/builds without errors
• Tests pass (make test)
• Linting passes for changed Rust/TypeScript surfaces
• Documentation updated (if applicable)
• No secrets committed
• Helm chart updated (if K8s changes)

Testing

• cargo test --locked -p kars-controller — 886 controller tests passed; phase taxonomy guard passed
• cargo clippy --locked -p kars-controller --bin kars-controller --no-deps -- -D warnings -A clippy::uninlined_format_args
• cargo fmt --all -- --check
• npm test -- --exclude src/commands/dev.test.ts — 928 stable CLI tests passed
• npm test -- --run src/commands/add.test.ts — 30/30 add-command tests passed
• npm run typecheck && npm run lint && npm run build — typecheck/build passed; lint reported 0 errors (29 pre-existing warnings outside this change)
• kubectl apply --dry-run=server -f deploy/helm/kars/templates/crd.yaml — CRD OpenAPI/CEL accepted by the API server
• bash -n for both OpenClaw scripts, plus executable bootstrap behavior tests covering IfMissing, Always, SHA-256 state manifest, file symlink rejection, and destination/state directory symlink rejection
• independent code review completed with no remaining Critical/Important findings

make test is intentionally left unchecked: the local repository-wide wrapper invokes unrelated Python/secret-scanner gates that currently fail on pre-existing fixtures and paths outside this diff. The component-native Rust and TypeScript suites above are the executable validation for this change.