test(workloadmanager): add unit tests for SandboxReconciler

What would you like to be added:
A new unit test suite under pkg/workloadmanager/sandbox_controller_test.go to cover SandboxReconciler (non-existent sandbox, pending sandbox, ready sandbox notification flow).
A fix in WatchSandboxOnce to close and clean up any pre-existing watcher channel for the same key to prevent goroutine leaks on duplicate registration.

Why is this needed:
SandboxReconciler currently has no unit test coverage, posing regression risks.
If WatchSandboxOnce is called twice for the same key, it silently overwrites the map entry, leaving the first channel permanently orphaned and block-waiting goroutines leaked.