feat: add Kubernetes executor (#3261)

apps/backend/internal/agent/runtime/lifecycle/default_scripts.go

@@ -11,6 +11,8 @@ func DefaultPrepareScript(executorType string) string {
 		return defaultWorktreePrepareScript
 	case "local_docker", "remote_docker":
 		return defaultDockerPrepareScript
+	case "k8s":
+		return defaultKubernetesPrepareScript
 	case "sprites":
 		return defaultSpritesPrepareScript
 	case executorTypeSSH:
@@ -130,6 +132,69 @@ git remote set-url origin "$(git remote get-url origin | sed 's|https://[^@]*@gi
 {{repository.setup_script}}
 `
 
+const defaultKubernetesPrepareScript = `#!/bin/sh
+# Prepare a Kubernetes Pod workspace. The workspace may be a retained PVC
+# mounted into a replacement Pod, so repository materialization is idempotent.
+
+set -eu
+
+workspace={{workspace.path}}
+repository_url={{repository.clone_url}}
+repository_branch={{repository.branch}}
+clone_tmp=/opt/kandev/.workspace-clone
+
+# ---- Git identity and HTTPS authentication ----
+{{git.identity_setup}}
+git config --global --add safe.directory '*'
+git config --global url."https://github.com/".insteadOf "git@github.com:"
+git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
+{{github.auth_setup}}
+
+mkdir -p "$workspace"
+if [ -n "$repository_url" ]; then
+  if git -C "$workspace" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    workspace_root=$(git -C "$workspace" rev-parse --show-toplevel)
+    if [ "$workspace_root" != "$workspace" ]; then
+      echo 'kandev: retained workspace repository root does not match the mount root' >&2
+      exit 1
+    fi
+    workspace_origin=$(git -C "$workspace" remote get-url origin 2>/dev/null || true)
+    expected_origin=$(printf '%s\n' "$repository_url" | sed 's|^https://[^/@]*@github.com/|https://github.com/|')
+    retained_origin=$(printf '%s\n' "$workspace_origin" | sed 's|^https://[^/@]*@github.com/|https://github.com/|')
+    if [ -z "$workspace_origin" ] || [ "$retained_origin" != "$expected_origin" ]; then
+      echo 'kandev: retained workspace repository origin does not match the configured repository' >&2
+      exit 1
+    fi
+  else
+    # A fresh filesystem-backed PVC may contain only lost+found. Preserve it,
+    # clone on the runtime emptyDir, then copy the checkout into the mount root.
+    if find "$workspace" -mindepth 1 -maxdepth 1 ! -name lost+found -print -quit | grep -q .; then
+      echo 'kandev: retained workspace is non-empty but is not a valid checkout' >&2
+      exit 1
+    fi
+    rm -rf "$clone_tmp"
+    trap 'rm -rf "$clone_tmp"' 0 1 2 15
+    git clone --depth=1 --branch "$repository_branch" "$repository_url" "$clone_tmp"
+    cp -a "$clone_tmp"/. "$workspace"/
+    rm -rf "$clone_tmp"
+    trap - 0 1 2 15
+  fi
+
+  cd "$workspace"
+
+  # Strip embedded token from remote URL to avoid persisting credentials.
+  git remote set-url origin "$(git remote get-url origin | sed 's|https://[^@]*@github.com/|https://github.com/|')" 2>/dev/null || true
+
+  # ---- Repository setup (if configured) ----
+  {{repository.setup_script}}
+else
+  cd "$workspace"
+fi
+
+# ---- Pre-install agent CLI(s) ----
+{{kandev.agents.install}}
+`
+
 const defaultSpritesPrepareScript = `#!/bin/bash
 # Prepare Sprites.dev cloud sandbox
 #