fix(k8s-driver): use dedicated kube client without read_timeout for watches

[sjenning]

Summary

The shared Kubernetes client's 30-second read_timeout was terminating long-lived watch streams during idle periods, causing a reconnect cycle every 30 seconds. This creates a dedicated watch_client with read_timeout: None for watch operations while preserving the timeout-protected client for CRUD operations.

Avoids these warnings in the openshell-server log

2026-04-21T14:54:28.803303Z  WARN openshell_server::compute: Compute driver watch stream errored error=status: Internal, message: "watch stream failed: Error reading events stream: ServiceError: error reading a body from connection", details: [], metadata: MetadataMap { headers: {} }

Changes

• Add a watch_client field to KubernetesComputeDriver with read_timeout: None
• Add watch_api() helper that uses the watch client
• Update watch_sandboxes to use the watch client for both sandbox and event watchers
• CRUD operations (create, get, list, delete) continue using the original timeout-protected client

Testing

• mise run pre-commit passes
• cargo check -p openshell-driver-kubernetes compiles clean
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.