fix(k8s): resolve attach pod name and su password on GKE Autopilot

[ameer00]

Summary

• Fix scion attach using bare agent name instead of grove-prefixed pod name (e.g., hello vs sciontest--hello), causing GKE Warden rejection
• Fix su - scion password prompt on GKE Autopilot where pods run as non-root with allowPrivilegeEscalation=false

Test plan

• Verified attach works with grove-prefixed pod names on GKE Autopilot
• Verified no password prompt when container already runs as target user
• Tested with Claude Code, Gemini CLI, OpenCode, and Codex harnesses

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request initializes the project's design documentation, including the backlog, progress logs, and release notes. It also introduces two key fixes to the Kubernetes runtime: correctly resolving pod names with grove prefixes and implementing a runtime check to skip the 'su' command if the container is already running as the target user, which prevents password prompts on GKE Autopilot. A security improvement was suggested to prevent potential shell injection by passing the username as a positional argument to the shell script instead of using string interpolation.

[gemini-code-assist]

Building shell commands by interpolating variables like username into a script string using fmt.Sprintf is susceptible to shell injection if the variable contains special characters (e.g., quotes, semicolons, or spaces). A more secure and robust approach is to pass the variable as a positional argument to the shell. This ensures the value is treated strictly as data and avoids any interpretation as part of the shell script structure.

Suggested change

	execCmd := []string{"sh", "-c", fmt.Sprintf(
	`if [ "$(whoami)" = "%s" ]; then exec tmux attach -t scion; else exec su - %s -c "tmux attach -t scion"; fi`,
	username, username)}
	execCmd := []string{"sh", "-c",
	"if [ \"$(whoami)\" = \"$1\" ]; then exec tmux attach -t scion; else exec su - \"$1\" -c \"tmux attach -t scion\"; fi",
	"--", username}