CodeInterpreter controller can delete unowned SandboxTemplate resources

What happened:

The CodeInterpreter controller assumes that any SandboxTemplate or SandboxWarmPool with the same namespace/name belongs to the CodeInterpreter.

Existing resources are updated without checking their owner reference. When warmPoolSize is zero, the same-named resources are deleted unconditionally. This can overwrite or delete resources created by another user or controller.

What you expected to happen:

The controller should only update or delete resources controlled by that CodeInterpreter. A name collision with an unowned resource should fail reconciliation and report a condition/event.

How to reproduce it (as minimally and precisely as possible):

1. Create a standalone SandboxTemplate named test.

2. Create a CodeInterpreter named test in the same namespace with a valid template and warmPoolSize: 0.

3. Wait for the CodeInterpreter controller to reconcile.

4. Run:

   kubectl get sandboxtemplate test

The original template is deleted.

The update path can also be reproduced with warmPoolSize: 1; the existing template spec is overwritten while its ownership is never verified.

Anything else we need to know?:

SetControllerReference is only called when creating a new child. The existing-resource update and delete paths do not check metav1.IsControlledBy or the controller UID.

Relevant code:
https://github.com/volcano-sh/agentcube/blob/0704bb96502af32f2bd90d47f1e11b4c8099959e/pkg/workloadmanager/codeinterpreter_controller.go#L143-L280

Environment:

• agentcube version: main (0704bb9)
• Kubernetes version: not version-specific
• Others: agent-sandbox v0.4.6