teardown: the workspaces NFS server stops before the node's mounts are released, leaving the kind node unkillable #595

Problem

The lab's workspaces NFS server is a ClusterIP service inside the kind cluster. A teardown (down, recreate, restore) that stops the server before the node's mounts of it are released leaves the node's NFS client in an unkillable wait: docker exec into the node fails with setns errors and the node cannot be stopped or removed without a host-level lazy unmount. Observed twice on one lab host in one evening.

#592 covers only detecting such a broken lab and failing fast; this issue is the cause.

Proposed solution

Teardown releases the workspace volumes first (drain or delete the pods that mount them, remove the PersistentVolumeClaims and PersistentVolumes, or unmount inside the node) and only then stops the NFS server and the cluster; the order is the same on every path that removes the server (down, recreate, restore).

Acceptance criteria

• A teardown of a lab with workspaces mounted by running pods leaves no node in an unkillable state.
• A test or proof covers the teardown with a mounted workspace volume.

Written by an agent.