build: update Go and Kubernetes dependencies

[acsoto]

What type of PR is this?

Dependency update and compatibility fixes.

What this PR does / why we need it:

Prepare the base dependencies for the agent-sandbox v1.0.2 upgrade:

• Go 1.26.8, Kubernetes modules/code-generator v0.37.0, controller-runtime v0.25.0 and controller-tools v0.22.0; regenerate clients and CRDs.
• Align the three Go builder images and CI Kind version, and update gomonkey for Darwin ARM64 compatibility.
• Use the apimachinery scheme builder and retain existing h2c Upgrade behavior.

Full E2E validation also exposed MCP 2.2.0 masking expected sandbox execution errors. Translate those errors to ToolError and add a nonzero-exit regression, while leaving unexpected exceptions masked.

Which issue(s) this PR fixes:

Part of #464 (base dependency prerequisite). The agent-sandbox dependency remains v0.4.6; the API migration in #446 and the subsequent sandbox upgrade remain separate.

Special notes for your reviewer:

AI assistance was used to prepare and validate this change.

Validation:

• Go unit tests and CI race/coverage command (65.3% combined statement coverage).
• Go lint, vet, formatting, module verification, Helm lint, build and reproducible code generation.
• Python lint and expected/unexpected MCP error regression checks.
• Local Docker Desktop Kubernetes v1.36.1 (ARM64): plain HTTP and SPIRE/mTLS E2E, including SDK, LangChain, MCP HTTP/stdio/in-cluster paths. Warm-pool and cold-session load tests: 100/100 and 20/20 successful requests.
• Verified expired-session deletion and HTTP 404 after the GC minimum inactivity window, plus rejection of TLS clients without certificates.

Direct-WorkloadManager tests intentionally skip in the mTLS run and are covered by the plain HTTP run. OIDC/Keycloak tests were not enabled locally. CI Kind now uses v0.33.0, whose default node image is Kubernetes v1.37.0.

Does this PR introduce a user-facing change?:

Update the Go toolchain to 1.26.8 and Kubernetes dependencies to v0.37.0. Preserve sandbox execution error details for MCP clients.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 59.99%. Comparing base (5903457) to head (907a66f).
⚠️ Report is 7 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/workloadmanager/server.go	0.00%	1 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #465   +/-   ##
=======================================
  Coverage   59.98%   59.99%           
=======================================
  Files          36       35    -1     
  Lines        3589     3592    +3     
=======================================
+ Hits         2153     2155    +2     
- Misses       1216     1218    +2     
+ Partials      220      219    -1     

Flag	Coverage Δ
unittests	59.99% <88.88%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[acsoto]

basic update @RainbowMango @pierre-gong

[pierre-gong]

/lgtm

[volcano-sh-bot]

@pierre-gong: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[RainbowMango]

/lgtm
/approve

[volcano-sh-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [RainbowMango]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment