fix: VM pods are taint-evicted after 5min of virtual-node NotReady, destroying VM state

[CMGS]

Incident (mindos cluster, 2026-07-18)

Kine DB lockup → the vk-cocoon node's lease renewals failed → node NotReady → after the default 300s, taint-eviction-controller batch-deleted every VM pod on the node (4 pods in the same second, including child-attention-monitor-sbx-0) → vk-cocoon executed DeletePod → Runtime.Remove destroyed each VM; the operator recreated the pods as fresh clones from the CocoonSet image, so running VM state was reset.

Root cause

newManagedPod tolerates only the vk provider taint:

Tolerations: []corev1.Toleration{
    {Key: meta.TolerationKey, Operator: corev1.TolerationOpExists},
}

Nothing tolerates node.kubernetes.io/not-ready / node.kubernetes.io/unreachable NoExecute, so the apiserver's DefaultTolerationSeconds admission plugin injects the default 300s pair, and any virtual-node NotReady longer than 5 minutes evicts every pod on it.

Taint eviction is pure loss for these pods:

• they are pinned to one virtual node (NodeSelector on the node pool); eviction cannot reschedule them anywhere;
• the virtual node's readiness reflects vk-cocoon's control-plane connectivity (lease renewal), not VM health — a control-plane DB lockup marks the node NotReady while every VM is fine;
• the healer for genuinely lost pods is the CocoonSet operator, not the taint-eviction-controller;
• vk-cocoon's DeletePod snapshots first (SnapshotPolicy default Always, when a Pusher is configured) but the recreate path boots fresh — the pushed snapshot is only auto-restored on the hibernate path — so eviction resets the VM.

Fix

Add permanent NoExecute tolerations for not-ready/unreachable in newManagedPod (no tolerationSeconds), the same pair the DaemonSet controller injects for node-pinned workloads. Explicit tolerations suppress the DefaultTolerationSeconds injection.

Acceptance criteria

• Agent and toolbox pods carry node.kubernetes.io/not-ready and node.kubernetes.io/unreachable Exists/NoExecute tolerations with nil tolerationSeconds.
• Tests pin both tolerations (a regression restoring the 300s default must fail).