PROD-4432 workbench operator support

Greptile Summary

Adds two new Kubernetes CRDs — Workbench and WorkbenchTool — along with their reconcilers, console client methods, and GraphQL query updates. The implementation follows the established Project controller pattern for CRUD, finalizer management, read-only mode, and drift detection. The GetAgentRuntimeByName query now requires a clusterId parameter, and the workbench/tool getter queries accept optional id/name parameters to support name-based lookups from the controller.

• Nil pointer dereference risk: WorkbenchToolHTTPConfig.Attributes() accesses c.InputSchema.Raw without checking if InputSchema is nil, which will panic at runtime if the pointer field is unset.
• Test mock mismatch: The workbench controller test uses agentRuntimeName = "test-agent-runtime" but the controller expects "clusterHandle/runtimeName" format. The test also omits the GetClusterByHandle mock and provides the wrong argument count for GetAgentRuntime. The create test likely passes coincidentally because the agent runtime error is swallowed by the requeue handler.
• Tag inconsistency: Method and InputSchema fields in WorkbenchToolHTTPConfig are annotated +kubebuilder:validation:Required but use omitempty in their JSON tags.

Confidence Score: 3/5

• Generally safe structural addition, but contains a nil dereference bug and test gaps that should be addressed before merge.
• The controllers and client code follow established patterns well and are structurally sound. However, the nil pointer dereference in InputSchema handling is a runtime crash risk, and the workbench controller test does not correctly exercise the agent runtime resolution path, masking potential integration issues.
• go/controller/api/v1alpha1/workbenchtool_types.go (nil pointer dereference), go/controller/internal/controller/workbench_controller_test.go (incorrect mocks)

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Workbench CR created/updated] --> B[WorkbenchReconciler.Reconcile]
    B --> C{Already exists in API?}
    C -->|Yes, read-only| D[handleExistingWorkbench - sync ID]
    C -->|No| E[addOrRemoveFinalizer]
    E --> F{Being deleted?}
    F -->|Yes| G[Delete from Console API & remove finalizer]
    F -->|No| H[Compute SHA diff]
    H --> I[Resolve ProjectRef]
    I --> J[Resolve RepositoryRef]
    J --> K[Resolve AgentRuntime - clusterHandle/runtimeName]
    K --> L[Resolve WorkbenchTool refs - collect IDs]
    L --> M[sync - Create or Update via Console API]
    M --> N[Update status: ID, SHA, conditions]

    O[WorkbenchTool CR created/updated] --> P[WorkbenchToolReconciler.Reconcile]
    P --> Q{Already exists in API?}
    Q -->|Yes, read-only| R[handleExistingWorkbenchTool - sync ID]
    Q -->|No| S[addOrRemoveFinalizer]
    S --> T{Being deleted?}
    T -->|Yes| U[Delete from Console API & remove finalizer]
    T -->|No| V[Compute SHA diff]
    V --> W[Resolve ProjectRef]
    W --> X[sync - Create or Update via Console API]
    X --> Y[Update status: ID, SHA, conditions]

    L -.->|owner ref| O

_{Last reviewed commit: 03068f8}