feat: Add sandbox claim label synchronization between Pod and Sandbox

[bcfre]

Ⅰ. Describe what this PR does

This PR introduces a new label LabelSandboxIsClaimed to track sandbox claim status and implements label synchronization between Sandbox and Pod resources.

Changes

1. Core Controller Enhancement

• Implement handleClaimSandbox() function to synchronize labels between Sandbox and Pod
  • Add missing labels from Sandbox to Pod
  • Remove labels from Pod that don't exist in Sandbox
  • Update Pod labels when values differ from Sandbox
• Use Strategic Merge Patch with null values for safe label deletion (avoids conflicts with other controllers)

2. SandboxSet Controller Updates

• Set LabelSandboxIsClaimed: "false" when creating new sandboxes
• Update label selector to include LabelSandboxIsClaimed: "false" for better sandbox filtering

3. Sandbox Manager Integration

• Set LabelSandboxIsClaimed: "true" when a sandbox is claimed by a user

Ⅱ. Does this pull request fix one issue?

fixes #46

Ⅲ. Describe how to verify it

Ⅳ. Special notes for reviews

HPA requires the scale subresource to expose a selector field, and it uses that selector to isolate different HPAs from each other, preventing them from targeting/claiming the same Pods.
https://github.com/kubernetes/kubernetes/blob/v1.35.0/pkg/controller/podautoscaler/horizontal.go#L397

func (a *HorizontalController) validateAndParseSelector(hpa *autoscalingv2.HorizontalPodAutoscaler, selector string) (labels.Selector, error) {
	if selector == "" {
		errMsg := "selector is required"
		a.eventRecorder.Event(hpa, v1.EventTypeWarning, "SelectorRequired", errMsg)
		setCondition(hpa, autoscalingv2.ScalingActive, v1.ConditionFalse, "InvalidSelector", "the HPA target's scale is missing a selector")
		return nil, errors.New(errMsg)
	}
        ...
	selectingHpas := a.hpasControllingPodsUnderSelector(pods)
	if len(selectingHpas) > 1 {
		errMsg := fmt.Sprintf("pods by selector %v are controlled by multiple HPAs: %v", selector, selectingHpas)
		a.eventRecorder.Event(hpa, v1.EventTypeWarning, "AmbiguousSelector", errMsg)
		setCondition(hpa, autoscalingv2.ScalingActive, v1.ConditionFalse, "AmbiguousSelector", "%s", errMsg)
		return nil, errors.New(errMsg)
	}
}

KEDA relies on HPA under the hood for autoscaling.

[kruise-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 45.75%. Comparing base (1390314) to head (de58980).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/sandbox-manager/infra/sandboxcr/pool.go	60.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #59      +/-   ##
==========================================
+ Coverage   45.71%   45.75%   +0.04%     
==========================================
  Files          75       75              
  Lines        4379     4386       +7     
==========================================
+ Hits         2002     2007       +5     
- Misses       2188     2189       +1     
- Partials      189      190       +1     

Flag	Coverage Δ
unittests	45.75% <75.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[furykerry]

/lgtm
/approve