Enable OwnerReferencesPermissionEnforcement in e2e and improve test failure diagnostic

[yongruilin]

This PR improves e2e test coverage for RBAC correctness and makes test failures easier to diagnose.

Enable OwnerReferencesPermissionEnforcement admission plugin in e2e kind cluster

• This admission plugin enforces that controllers must have finalizers subresource permission to set blockOwnerDeletion in ownerReferences
• It is not enabled by default in Kubernetes but is commonly enabled in hardened clusters (e.g. OpenShift)
• Without it, e2e tests miss RBAC issues like controllers/sandbox_controller: add RBAC for finalizers #377

Add missing finalizers RBAC for extensions controllers

• Add sandboxclaims/finalizers and sandboxwarmpools/finalizers RBAC markers so the SandboxClaim and SandboxWarmPool controllers work with OwnerReferencesPermissionEnforcement enabled
• Regenerate extensions-rbac.generated.yaml

Dump controller logs on e2e test failure

• On failure, write full controller logs to $ARTIFACTS (available in Prow) and print last 42 lines to test output
• Follows the https://github.com/kubernetes/kubernetes/blob/master/test/e2e/framework/pod/resource.go for log tail length

Fix e2e watch timeout propagation

• Watch/MustWatch now accept a context.Context parameter so the timeout set by WaitForObject actually propagates to the watch loop
• Cap WaitForObject and PollUntilObjectMatches at DefaultTimeout (60s) even when the parent context has a longer deadline
• Previously, tests hung for 10 minutes until Go's test timeout panic killed the process, bypassing all cleanup (including log dumping). Now tests fail gracefully in ~60s with controller logs in the output.

[netlify]

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	23144a9
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/69b1f83103c9be0009f97418

[yongruilin]

Have expected error

        2026-03-11T00:19:51Z	ERROR	Error creating sandbox for claim	{"controller": "sandboxclaim", "controllerGroup": "extensions.agents.x-k8s.io", "controllerKind": "SandboxClaim", "SandboxClaim": {"name":"python-sandbox-claim","namespace":"python-sandbox-claim-test-1773188350549572278"}, "namespace": "python-sandbox-claim-test-1773188350549572278", "name": "python-sandbox-claim", "reconcileID": "dd7da7ad-b016-49e2-bdcc-df39a2011d60", "claimName": "python-sandbox-claim", "error": "sandbox create error: sandboxes.agents.x-k8s.io \"python-sandbox-claim\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>"}

/hold for #377

[yongruilin]

/hold cancel
#377 merged

[yongruilin]

/retest

[natasha41575]

/lgtm

[natasha41575]

/assign @janetkuo

[natasha41575]

/lgtm

[janetkuo]

/lgtm

Thanks!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aditya-shantanu, janetkuo, yongruilin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [janetkuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment