fix(k8s): respect template OPENSHELL_SANDBOX_COMMAND instead of overwriting

[Arnonrgo]

Summary

• apply_required_env() unconditionally overwrites OPENSHELL_SANDBOX_COMMAND with "sleep infinity"
• Custom sandbox images cannot specify their own entrypoint command
• Use upsert_env_if_absent() so template values take precedence

Changes

• Add upsert_env_if_absent() helper that only inserts if the env var doesn't already exist
• Change OPENSHELL_SANDBOX_COMMAND injection to use the new helper

Testing

• Unit test: existing value is preserved (not overwritten)
• Unit test: absent value gets default "sleep infinity"
• Unit test: full apply_required_env preserves template command
• cargo check -p openshell-driver-kubernetes passes

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @Arnonrgo.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[maxamillion]

@Arnonrgo your PR looks good but unfortunately now there's a conflict and we still need the DCO signing. Thank you! :)