feat(kubernetes): prototype proxy-pod isolation backend

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

Cargo.lock

@@ -16,9 +16,11 @@ path = "src/main.rs"
 
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false }
+openshell-isolation-interface = { path = "../openshell-isolation-interface" }
 openshell-otel = { path = "../openshell-otel" }
 openshell-policy = { path = "../openshell-policy" }
 
+async-trait = "0.1"
 opentelemetry = { workspace = true }
 tokio = { workspace = true }
 tonic = { workspace = true, features = ["transport"] }

crates/openshell-driver-kubernetes/Cargo.toml

@@ -49,6 +49,29 @@ this driver. Kubernetes owns scheduling and pod lifecycle. The
 `openshell-sandbox` supervisor inside each workload owns agent isolation,
 credential injection, policy polling, logs, and the gateway relay.
 
+### RFC 0012 proxy-pod prototype
+
+The crate contains a review-only `kubernetes-proxy-pod` Isolation Backend
+adapter. It is not registered by the gateway and does not change the default
+runtime model. The adapter defines the boundary between the common RFC 0012
+lifecycle and a future authenticated Kubernetes process-leaf transport:
+
+- The topology descriptor binds the sandbox to immutable workload Pod and
+  egress `NetworkPolicy` UIDs, not reusable object names.
+- `attach` reserves that resource pair and asks the trusted process leaf to
+  bind the complete sandbox context atomically.
+- `confirm` requires evidence that the workload is still held, the exact
+  egress fence is active, all workload egress goes through mediation, and
+  accepted connections carry trusted binary identity.
+- `start_agent` releases the admitted workload and returns the mandatory
+  process, exec, and loopback-forwarding interfaces.
+
+Kubernetes resource rendering and the authenticated control protocol remain
+follow-up layers. In particular, the adapter intentionally cannot represent a
+pod-level fence that also grants the workload direct DNS or gateway access, or
+an explicit proxy that drops process attribution. Those modes do not satisfy
+RFC 0012's egress and binary-identity invariants.
+
 ## Sandbox Resource
 
 The driver works with the `agents.x-k8s.io` `Sandbox` custom resource. It