feat(kubernetes): support private PVC subpaths for non-root workloads #5047

User Story

I run agent workloads in OpenShell on Kubernetes and need persistent state directories owned by the sandbox UID with mode 0700.

Problem Statement

Kubelet-created PVC subpaths can be root-owned and group-writable. Setting fsGroup provides group access but does not change the owner UID. Applications with strict state-directory checks reject these directories.

Impact / Why This Matters

Today, I use a separate preparation Deployment before creating the sandbox. This adds Kubernetes resource management and cleanup outside OpenShell.

The OpenClaw Enterprise workaround is one example.

Proposed Design

Add an opt-in ensure_private_subpath setting to Kubernetes driver volume mounts. Before the workload starts, prepare the selected directory with sandbox ownership and mode 0700, preserving existing contents.

Example mount configuration:

{
  "name": "data",
  "mount_path": "/sandbox/state",
  "sub_path": "state",
  "read_only": false,
  "ensure_private_subpath": true
}

Acceptance Criteria

• Selected subpaths are owned by the sandbox UID with mode 0700.
• Existing contents survive preparation and retries.
• Unsafe paths and conflicting recovery state block startup without data loss.
• Read-only mounts and PVC-root mounts reject the option.
• Mounts without the option retain existing behavior.

Alternatives Considered

A separate preparation Deployment works but requires coordinating another writer and its cleanup. Middleware, interceptors, and credential providers do not directly address filesystem ownership before workload startup.