Vouch request: vassilnk

[vassilnk]

What do you want to work on?

Currently OpenShell Kubernetes driver only allows configuring sandbox pod image pull secrets at a Gateway-wide level through a config - gateway.toml - read at Gateway startup. This is inconvenient in scenarios where end-users have no access to the control plane.
Additionally currently reconfiguring the image_pull_secrets bears a runtime impact as it requires a gateway restart which causes temporary interrupts to connections to the sandboxes through the control plane.
In multi-tenant setups, tenants would benefit from being able to reference their own registry secrets at sandbox creation time without needing administrative access to the Gateway.
Adding a new per-sandbox driver_config for the kubernetes driver passed at sandbox creation time seems a straightforward solution that closes this gap.

P.S. A similar issue - #2676 - already exists for the Docker driver side and a comment on it mentions the need for a compute-driver agnostic solution - the current proposal to use driver_config is applicable to any compute-driver, so should be aligned with this requirement.

Why this change?

At my currently company we need to allow our customers to deploy agent workloads from private registries, so managing registry access without this is quite cumbersome and we are looking to contribute this.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md