Extract env var conversion to fix gocyclo complexity

DeployWorkload exceeded gocyclo's 15-branch threshold after the
deterministic env var sorting was added. Move the conversion into
a dedicated helper to keep DeployWorkload under the limit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ChrisJBurns

pkg/container/kubernetes/client.go

@@ -358,19 +358,7 @@ func (c *Client) DeployWorkload(ctx context.Context,
 
 	attachStdio := options == nil || options.AttachStdio
 
-	// Convert environment variables to Kubernetes format.
-	// Sort keys so the resulting list is deterministic — Go map iteration
-	// is randomized, and any ordering shift here changes the pod template
-	// hash and triggers an unnecessary StatefulSet rollout (#5063).
-	envKeys := make([]string, 0, len(envVars))
-	for k := range envVars {
-		envKeys = append(envKeys, k)
-	}
-	sort.Strings(envKeys)
-	envVarList := make([]*corev1apply.EnvVarApplyConfiguration, 0, len(envKeys))
-	for _, k := range envKeys {
-		envVarList = append(envVarList, corev1apply.EnvVar().WithName(k).WithValue(envVars[k]))
-	}
+	envVarList := buildSortedEnvVarList(envVars)
 
 	// Create a pod template spec
 	podTemplateSpec := ensureObjectMetaApplyConfigurationExists(corev1apply.PodTemplateSpec())
@@ -457,6 +445,23 @@ func (c *Client) DeployWorkload(ctx context.Context,
 	return 0, nil
 }
 
+// buildSortedEnvVarList converts an env var map to Kubernetes apply configurations
+// with deterministically ordered keys. Go map iteration is randomized, and any
+// ordering shift changes the pod template hash and triggers an unnecessary
+// StatefulSet rollout (#5063).
+func buildSortedEnvVarList(envVars map[string]string) []*corev1apply.EnvVarApplyConfiguration {
+	envKeys := make([]string, 0, len(envVars))
+	for k := range envVars {
+		envKeys = append(envKeys, k)
+	}
+	sort.Strings(envKeys)
+	envVarList := make([]*corev1apply.EnvVarApplyConfiguration, 0, len(envKeys))
+	for _, k := range envKeys {
+		envVarList = append(envVarList, corev1apply.EnvVar().WithName(k).WithValue(envVars[k]))
+	}
+	return envVarList
+}
+
 // runConfigGeneration extracts the RunConfig MCPServer generation from options,
 // returning 0 when options is nil (backward-compat / non-operator callers).
 func runConfigGeneration(options *runtime.DeployWorkloadOptions) int64 {