fix(plugin): bound kubernetes sandbox execution

packages/plugins/sandbox-providers/kubernetes/test/unit/pod-exec.test.ts

@@ -38,4 +38,13 @@ describe("execInPod", () => {
       stderr: expect.stringContaining("websocket closed before status frame"),
     });
   });
+
+  it("returns an execution failure if the exec command exceeds its deadline", async () => {
+    execMock.mockResolvedValue(new EventEmitter());
+
+    const result = await execInPod({} as never, "ns", "pod-1", "agent", ["sleep", "60"], undefined, 5);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("Kubernetes exec timed out after 5ms");
+  });
 });

packages/plugins/sandbox-providers/kubernetes/test/unit/sandbox-cr-orchestrator.test.ts

@@ -213,4 +213,16 @@ describe("waitForSandboxReady", () => {
       }),
     ).rejects.toThrow(/failed.*OOMKilled/i);
   });
+
+  it("fails fast when Sandbox starts terminating before it is ready", async () => {
+    const get = vi.fn().mockResolvedValue(makeCr("Terminating"));
+    const clients = { custom: { getNamespacedCustomObject: get } };
+    await expect(
+      waitForSandboxReady(clients as never, "ns", "pc-abc", {
+        timeoutMs: 5000,
+        pollMs: 10,
+      }),
+    ).rejects.toThrow(/terminating before it became ready/i);
+    expect(get).toHaveBeenCalledTimes(1);
+  });
 });