[grs]

Summary

Add template-driven warm pooling for Kubernetes sandboxes with dedicated or shared supervisors. Prepared runtimes wait for a claim, then receive their sandbox identity and credentials over existing supervisor connections, avoiding cold startup and claim-time Secret projection delays.

Related Issue

Closes #2157

Changes

• Derive warm pools from template startup tuning (ready_within and max_burst), with pooling enabled by default and operator-configurable limits.
• Coordinate preparation, capacity reservation, claims, refill, and retirement through durable records shared across gateway replicas.
• Hold dedicated supervisors’ asynchronous RegisterSupervisor responses until claim; deliver shared-supervisor claims through the existing assignment stream.
• Preserve physical runtime identity and validate credentials before activation, without adding a runtime-to-gateway bootstrap connection.
• Restrict claims to the originating template and drain unclaimed capacity when a template is deleted or pooling is disabled.
• Update Helm permissions, configuration documentation, and lifecycle coverage.

Release Notes

Kubernetes sandbox templates can request warm capacity using --ready-within and --max-burst. Pooling supports dedicated and shared supervisors and creates no spares for templates without startup tuning. Sandbox creation falls back to cold provisioning when no compatible spare is available.

Testing

• Checks appropriate to the affected code and behavior pass

• Unit tests added/updated

• E2E tests added/updated

• Manual basic operation verified with both supervisor topologies.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.