feat: add nsenter-based command execution in tools sidecar with full test coverage

[l50]

Key Changes:

• Added logic to execute commands within the tools container using nsenter for
  improved isolation and compatibility
• Introduced automated detection of the tools container PID via process listing
• Implemented detailed integration tests for PID discovery and command execution
• Updated dependencies and build config to support direct git reference installs

Added:

• nsenter-based command execution: RedisWorkerAgent now runs commands in the
  tools sidecar's mount namespace using nsenter, requiring shareProcessNamespace
  and CAP_SYS_ADMIN for proper operation
• Tools container PID discovery: Added method to scan running processes for
  "sleep infinity" and select the correct PID for namespace entry
• Comprehensive integration tests: Test cases for PID discovery, error handling,
  command execution success/failure, permission errors, timeouts, and PID caching
  in test_redis_task_queue_integration.py
• Direct dependency reference: Added rigging as a git-based dependency in
  pyproject.toml and uv.lock for up-to-date source usage

Changed:

• RedisWorkerAgent command execution: Replaced previous subprocess logic with
  nsenter-based invocation, including error handling for missing tools container,
  missing capabilities, and general execution errors
• Dependency management: Updated pyproject.toml and uv.lock to allow direct
  references and to pin rigging to a specific commit via git URL
• Build config: Enabled allow-direct-references in Hatch metadata for direct
  dependency support

Removed:

• Static wheel/sdist source URLs for rigging: These are now replaced by a git
  source reference for more precise dependency management

[linear]

CAP-853 Execute Commands in Tools Sidecar via nsenter

Description:
Update the RedisWorkerAgent to execute command tasks within the tools sidecar container using Linux namespace isolation (nsenter). This ensures commands run inside the correct container context by targeting the sidecar's mount namespace. Implements robust error handling and provides detailed results for command execution.

---

Objective:

Enable command execution within the tools sidecar container from the worker agent by leveraging nsenter, ensuring proper namespace targeting, error handling, and result reporting.

---

Scope of Work:

• Implement _find_tools_container_pid() to locate the tools container process ID by parsing ps aux output for sleep infinity processes, excluding grep.
• Update _execute_command_task() to:
  • Use nsenter with the located PID to run commands in the tools container's mount namespace.
  • Cache the tools container PID after first lookup for efficiency.
  • Provide clear error messages for: missing tools container, permission denied, and command timeouts.
  • Return stdout, stderr, and return code in the command results.
• Ensure the pod configuration meets requirements (shareProcessNamespace: true, appropriate entrypoint, necessary capabilities).
• Add or update tests:
  • 5 tests for _find_tools_container_pid()
  • 7 tests for _execute_command_task() with nsenter

---

Dependencies:

• Pod must be configured with shareProcessNamespace: true
• Tools container must use sleep infinity as its entrypoint
• Worker container must have CAP_SYS_ADMIN capability
• None identified beyond above prerequisites

---

Acceptance Criteria:

1. Commands executed via the worker agent run within the tools sidecar container using nsenter.
2. _find_tools_container_pid() reliably returns the correct PID or None if not found.
3. _execute_command_task() returns stdout, stderr, and return code for each execution.
4. Clear, actionable error messages are returned for missing container, permission issues, and timeouts.
5. All new and updated tests for both methods pass successfully.

---

Additional Notes:

• Reference the branch fix/stuff for implementation details.
• Ensure robust logging for troubleshooting common errors.
• See Kubernetes documentation for configuring shareProcessNamespace and container capabilities:
  https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/

---