feat(supervisor): label a run pod with the isolation lane it ran in

The Kubernetes workload manager now sets a `compute.trigger.dev/runtime`
label on the run pods it creates, recording the isolation lane the run
executed in. This is the isolation lane, not the task runtime, so the
value is always `container` on this path.

Mono-RevId: f01751f8b86f630dec76a7b2776b10953aecc840

Author: 1stvamp

apps/supervisor/src/workloadManager/kubernetes.ts

@@ -415,6 +415,8 @@ export class KubernetesWorkloadManager implements WorkloadManager {
       // The schedule vs non-schedule distinction is all we need for the current metrics
       // and pool-level scheduling decisions; finer-grained source breakdowns live in run annotations.
       scheduled: String(this.#isScheduledRun(opts)),
+      // The isolation lane, not opts.runtime (the task runtime).
+      "compute.trigger.dev/runtime": "container",
     };
 
     // Add privatelink label for CiliumNetworkPolicy matching