fix(deploy): use sandboxd resources and correct node dashboard

[WenYuLuo]

Adxlet currently uses local auto resource detection even though the Kubernetes, Aliyun and Huawei Cloud profiles enable sandboxd's Kubernetes resource provider. Read sandboxd's /resource endpoint over /var/run/resource.sock so scheduling capacity and device inventory use the configured runtime provider. Add a rendered cross-profile socket contract and update deployment documentation.

Also fix the monitor chart's ADX node-status table for Grafana 11.5.2: change its nine-query join from outerTabular to outer to prevent repeated sparse node rows and incorrect Unknown cells. This matches openJiuwen-ai/agent-dx#88.

The E2E guide now describes network-tunnel-block alongside the other network tests, retaining listener ports, policy transitions, the 10-second recovery requirement, blocked-service checks and cleanup requirements.

Validation:

• The new resource-source contract first failed with auto != sandboxd; after the fix, 40 focused checks passed (10 observability, 27 chart, 3 Terraform).
• All seven rendered monitor dashboard JSON files parse; panel 15 retains nine queries and ten columns, with its join mode as the only dashboard change.
• git diff --check passed.

Live deployment validation (resource-source change only):

• Updated akernel-core in namespace akernel on cn-north-4 akernel-cce, Helm revision 100 → 101. Retained the deployed image digest, reused existing release values, preserved control-role Pods, and limited worker rolling updates to one unavailable Pod.
• All four workers report identical CPU/memory/storage capacity through sandboxd UDS, adxlet and Coordinator. CPU/memory also match Kubernetes Allocatable minus Pod requests using the deployed sandboxd version's rounding policy.
• A temporary Pod requesting 1 CPU and 1 GiB reduced capacity by exactly that amount through UDS, adxlet, Coordinator and Prometheus; deletion restored baseline capacity. All four workers are fresh, accepting and reachable, and the test Pod was removed.

The monitor-dashboard change was validated by rendering and was not deployed in this cluster update. This run retained the existing binaries and does not establish a newly built image or Aliyun runtime validation.

[rcyw]

Correction: the previously raised zero-capacity case follows an existing documented ADX TTL fallback, whose implementation predates this PR. I withdraw the initial merge-blocking P2 recommendation. Local reproduction and optional policy refinement are tracked separately in #113 (#113); no new regression or RC blocker has been established. This remains a comment-only review, not approval. No merge, SDK publication or cluster upgrade was performed.

[rcyw]

Approved at 0159ab933561440f7fc19290d29162867801331c.

Using sandboxd's configured Kubernetes resource provider aligns adxlet's scheduling capacity and device inventory with the deployment configuration. The Grafana outer join is appropriate for these queries' unique (adx_env, node_id) keys and was verified against Grafana 11.5.2 behavior. The E2E documentation matches the current pinned tunnel coverage.

Validation: 38 local core chart/observability/resource checks and 3 Terraform contracts passed, core/monitor Helm lint passed, all 7 rendered dashboard JSON files parsed, and the nine-query join correctly produced one complete row per node while preserving missing metrics. The current GitHub test checks, including Standalone E2E, are successful. No new cloud deployment was performed for this review.

No remaining blocking findings. #113 separately tracks the existing zero-capacity/TTL policy boundary; the cache/expiry behavior predates this PR and is not a confirmed regression or a release prerequisite. My earlier merge-blocking recommendation has been withdrawn. This approval does not merge the PR or resume SDK publication or cluster upgrades.