[matthewgrossman]

Summary

Many workloads do not exit immediately on TERM, for example while they run cleanup handlers. Add an all-driver conformance test requiring that deleting such a running sandbox still completes promptly, rather than waiting out the runtime's termination grace period.

Related Issue

Closes #5290.

Related to #5285, which remains open for stronger signal-processing and runtime-termination evidence. #5290 has no acceptance label; the author has verified ADMIN access.

Changes

• Run a workload whose TERM handler waits TERM_HANDLING_DELAY (3 s) before exiting, and synchronize on a readiness marker written after the trap is installed.
• Require deletion and absence from get/list within one shared DELETE_DEADLINE (10 s) that starts before deletion.
• Document the lifecycle suite coverage.

Why these values:

• 3 s delay: the workload must still be handling TERM when the boundary receives its own TERM. Locally that came up to ~0.85 s after the workload's TERM. The delay stays below the supervisor's 5 s wait before it kills the workload, so the test does not exercise that escalation path.
• 10 s deadline: well below the 30 s Kubernetes grace period that a shutdown hang waits out, with headroom over the ~4 s normal deletion.

The assertion is prompt deletion, not graceful workload exit or proof that every runtime process avoids SIGKILL. OpenShell may kill the workload before its handler finishes.

Release Notes

Testing

• Relevant checks pass: conformance Rust formatting, lifecycle Clippy with warnings denied, and git diff checks.
• E2E test added. On local Linux arm64 k3s/containerd, using public deletion with only the boundary image varied:

TERM delay	Baseline d7da0c7	Baseline plus #5279 boundary change
1 s	32.0 s, 32.4 s	4.1 s, 4.7 s
3 s	32.6 s, 31.4 s	4.1 s, 4.2 s

• The final test passes against the fix(sandbox): bound runtime shutdown after SIGTERM #5279 boundary image. With 1 s it also failed against baseline at the deadline. The 3 s baseline numbers come from the same workload driven by an experiment script, not from the final test.

Other compute drivers and amd64 CI have not been exercised locally. The unchanged supervisor still waits for forced killing in this Kubernetes setup, even when public deletion completes within the deadline. This PR contains only the test, not the #5279 fix; it is expected to fail on builds without that fix.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[elezar]

LGTM.