Update pods/ephemeralcontainers to inject a debug container into an existing running Pod.

The debug container runs in the target Pod context and can access the Pod's mounted volumes, ServiceAccount token, and selected process namespace depending on target/runtime support.

Powerful lateral movement inside privileged Pods.

Not the same as kubectl debug node/<name>, which requires create pods and spawns a separate privileged Pod.