fix(ci): wait for controller reconciliation before Kubernetes conformance - #4676

Summary

Kubernetes conformance currently starts when the gateway connects, even if Agent Sandbox is still recovering after guest boot. This can fail the first sandbox creation before scenario assertions run. This PR waits for controller reconciliation before starting conformance and collects controller diagnostics when preparation or tests fail.

Related Issue

Closes #4675.

Changes

• Verify reconciliation with a temporary Sandbox and its controller-owned Pod. A scheduling gate prevents the Pod from running or pulling an image.
• Retry temporary API failures and remove the probe and dependent resources on success or failure. Skip conformance and collect diagnostics if preparation fails.
• Collect controller state, leader leases, events, and bounded current and previous logs. Retain startup and recent log sections.
• Update the Actions troubleshooting skill with controller diagnostics guidance. Production provisioning deadlines and ownership checks remain unchanged.

Testing

• All eight archived conformance tests passed in 298.4 seconds on an ARM64 Ubuntu 24.04 guest with K3s 1.29.15 and Agent Sandbox 0.5.0. Runtime artifacts came from be9d7a0561cfd55b1ca426f0217e283a4e28b6b8. The probe waited 10.9 seconds through controller recovery, then cleaned up.
• Isolated checks covered delayed leadership, stopped-controller cleanup and conformance skipping, and retry after a temporary apply failure.
• The diagnostic collector ran in the VM. A 400 KB log fixture retained startup/recent markers and command failure status within the output limit. ShellCheck passed.

Local VM validation used ARM64; the original CI failure used x86-64. The local controller certificate error and recovery do not establish the original failure's exact cause.

Checklist

• Follows Conventional Commits.
• Commits are signed off for DCO.
• Contributor troubleshooting guidance updated; runtime architecture is unchanged.