Currently, the SandboxWarmPool controller does not trigger a rollout when its spec.sandboxTemplateRef is changed or when the underlying SandboxTemplate specification is mutated. This results in state drift where the pool serves stale pods to new SandboxClaims.

While we don't necessarily need rollouts for Sandbox or SandboxClaim resources (because they handle active, singleton workloads), a SandboxWarmPool becomes ineffective if it cannot guarantee that provisioned resources match the most recent template configuration (because it handles idle, unclaimed resources).

As mentioned in the original design #34 (comment), we only need to do a recreate (kill all old ones and create new ones) instead of a rolling update.

#162 proposes to have warmpool create sandboxes instead of pods, so might affect the design of this feature.

/kind feature