Add toleration for prepull daemonset

[amdove]

Adds toleration for prepull daemonset to run on tainted nodes. This is needed specifically to make sure it's running when Karpenter nodes are configured with session taints. Omitting this isn't breaking functionality completely, but is preventing prepull from doing what it should be to pre-pull images to nodes that will run sessions.

[claude]

Claude finished @amdove's task —— View job

---

Review Complete

• Read review guidelines
• Analyze code changes
• Create pending review
• Submit review with inline comments

Reviewed the toleration change. The universal toleration approach is correct for a prepull daemonset. Left one suggestion about removing the now-redundant workbench tolerations block.

[claude]

Review Summary

The change correctly adds a universal toleration (Operator: TolerationOpExists) to ensure the prepull daemonset runs on all nodes regardless of taints. This is appropriate for a prepull daemonset since images should be cached on every node.

One consideration:

The universal toleration makes the workbench-specific tolerations block (lines 114-121) redundant since TolerationOpExists already tolerates everything. You could:

1. Remove the workbench tolerations block entirely, or
2. Keep it with a comment explaining why (e.g., for documentation/visibility)

Otherwise, the implementation follows existing patterns and the reconciliation remains idempotent.