Proposal: idle suspend + explicit wake (interim before upstream KEP-968)

Discovery issue for ADR-0009 (proposal, not implementation commitment).

With `spec.operatingMode: Suspended` native in v1beta1, the suspend/resume
mechanism is upstream's; what remains open upstream is automatic idle detection
(kubernetes-sigs/agent-sandbox#849) and transparent wake (KEP-968). Interim
idea: implement ONLY the thin trigger layer.

- **Idle detection:** a scheduled function (extending this sample's existing
scheduled cost-enforcer Lambda pattern) combining two signals — no gateway
traffic AND pod CPU below a floor for a configurable window — then patch
`operatingMode: Suspended`. Dual-signal *reduces but does not eliminate* the
risk of suspending active background agent work; the ADR must define the
residual risk and a per-tenant opt-out.
- **Wake:** control-plane, not data-path. The web front door serves a
"waking up" page and calls a wake API. The ADR MUST specify: tenant-scoped
authorization (a tenant can only wake its own sandbox), readiness condition
before redirect, idempotency, and timeout/error UX.
- **Non-goals:** no buffering proxy, no transparent wake claim, no assumption
that upstream KEP-968 will be API-compatible with this trigger.
- **Alternatives considered:** wait for upstream KEP-968 vs. this thin trigger
layer — chosen for interim value, explicitly non-blocking on upstream.
- **Measurement before "savings" claims:** wake-accepted → route-healthy
p50/p95, fixed window, baseline compute; report as adopter evidence on
KEP-968/#849.
- Conformance script: add suspend → resume cycle as check 5.

Depends on #13. Part of #5.

Start by reading ADR-0009 and dependency #13, then inspect the existing scheduled cost-enforcer Lambda pattern and the conformance script. Define the interim idle trigger and control-plane wake requirements in the ADR, including tenant authorization, readiness, idempotency, errors, opt-out, and measurement; add suspend → resume as conformance check 5.

Written by the indexing model from the issue text.