fix(kubernetes): validate sandbox names against RFC 1123 requirements

[2000krysztof]

Summary

This PR adds a call to the validate_kubernetes_dns1123_label inside of create_sandbox function.

Related Issue

Fixes #2115

Changes

• display errors if the name is invalid
• calls the validation function inside of the create_sandbox function to intercept the name before the creation happens to display the error

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• This was also tested on an openshift 4.21 cluster to verify if the changes actually work

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[elezar]

Thanks for adding validation before the Kubernetes API call. I think this should reuse the DNS-1123 validation we already have instead of introducing a second sandbox-name validator.

crates/openshell-driver-kubernetes/src/driver.rs already defines validate_kubernetes_dns1123_label() and validate_kubernetes_dns1123_subdomain() near the existing driver volume validation code. The label helper enforces the same shape needed here: non-empty, max 63 chars, lowercase alphanumeric or -, and start/end alphanumeric. It is already covered by the driver-config DNS-1123 tests.

Please replace the new validate_k8s_name() implementation with a call like:

validate_kubernetes_dns1123_label(&sandbox.name, "sandbox.name")
    .map_err(KubernetesDriverError::InvalidArgument)?;

That keeps the Kubernetes driver on one validation primitive and avoids two slightly different RFC 1123 implementations drifting over time. If we want better sandbox-specific wording, we should add that around the existing helper or promote a shared helper into openshell_core, rather than duplicating the parsing logic.

[2000krysztof]

I have read the DCO document and I hereby sign the DCO.

[2000krysztof]

recheck

[2000krysztof]

The function was removed, and I replaced the call in the create sandbox function with the existing function. The tests were also removed for the new function and two tests were added that test the validate_kubernetes_dns1123_label were added to check for these edge cases.

[elezar]

Thanks. Looks good now.

[elezar]

/ok-to-test e96b64d

[github-actions]

Label test:e2e applied for e96b64d. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e-kubernetes applied for e96b64d. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute Kubernetes HA E2E after building the required gateway and supervisor images once. This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status.