fix(helm): preflight Agent Sandbox APIs

[elezar]

Summary

Fail Helm installation early when a cluster lacks a supported Agent Sandbox API, and make the release canary install the same controller dependency used by Kubernetes E2E. This addresses the failed Kubernetes Helm (kind) canary job.

Related Issue

No issue required: localized Helm and release-canary regression fix. Related context: #2013 and #2009.

Changes

• Add an enabled-by-default Helm API preflight with an offline-rendering override.
• Provision Agent Sandbox in the kind release canary before chart installation.
• Share the controller installation and readiness sequence between Kubernetes E2E and canary.
• Document the cluster-scoped prerequisite and local canary reproduction.

Testing

• mise run pre-commit passes
• Helm unit tests, lint, and generated-docs check
• Shell syntax, workflow YAML, and mocked Agent Sandbox helper command-sequence checks
• Full Kubernetes E2E run

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs:https://nvidia-preview-pr-2867.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 22e9812. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[elezar]

/ok-to-test 22e9812