Start a debug container

Where: a Pod resource detail, debug container. This changes the Pod by adding an ephemeral container and requires the API, image pull, admission, runtime, and RBAC support.

1. Confirm context, namespace, Pod name and UID.
2. Choose the target container, approved image, profile, and command.
3. Review the confirmation and context-protection state, then start the session.
4. Close the terminal when finished.

An ephemeral container persists in the Pod specification until the Pod is replaced; closing the terminal does not remove it. UID changes abort attachment. Prefer normal shell only when the existing container has a suitable command.

Source: src/components/ResourceDetailDrawer.tsx, src-tauri/src/k8s/debug.rs, src/components/shell/ShellPanel.tsx at v0.18.0.