fix(worker): accept materialized Agent Sandbox workspace

[haasonsaas]

Root cause

Production Dex gate runs 31589458577, 31590157083, 31590486993, 31590862560, and 31591187477 proved that managed Agent Sandbox claims bind to Ready warm pods, then the dedicated worker fails before activation and rolls the claim back. The worker accepted only an inline ephemeral.volumeClaimTemplate in the claimed Pod. The managed Sandbox controller materializes that generic ephemeral workspace as the canonical direct PVC reference, so the worker rejected the controller-owned representation before verifying its already-strict Pod owner fence.

Change

• accept either the inline generic-ephemeral volume or its canonical materialized PVC reference;
• require the exact <pod-name>-sandboxwich-workspace claim name;
• retain the existing namespace and exact Pod name/UID/controller-owner verification before use;
• reject foreign or noncanonical PVC references.

Verification

• rustup run 1.95.0 cargo fmt --check — passed
• rustup run 1.95.0 cargo clippy --workspace --all-targets -- -D warnings — passed
• rustup run 1.95.0 cargo test --workspace — passed
• focused Agent Sandbox workspace tests — passed
• Postgres-backed contract tests did not run locally because SANDBOXWICH_TEST_POSTGRES_URL is not configured.

After merge, the container release and protected GitOps promotion must publish this exact worker change before the Platform Dex Turn Deploy Gate and fresh canonical Deixic conversation-to-computer smoke are rerun.