[BUG] NodePodProbe can panic when marker policy adds labels to a pod without labels #2499

What happened:

NodePodProbe can panic when applying marker labels to a Pod whose metadata.labels is nil.

In pkg/controller/nodepodprobe/node_pod_probe_controller.go, the reconcile path initializes podClone.Annotations before writing annotations, but it does not initialize podClone.Labels before writing labels from probeMetadata.Labels.

If a matched PodProbeMarker policy adds a label to a Pod without labels, this assignment can panic:

podClone.Labels[k] = v.(string)

with:

assignment to entry in nil map

What you expected to happen:

The controller should safely initialize podClone.Labels before writing marker labels, just as it already does for annotations.

How to reproduce it (as minimally and precisely as possible):

1. Have a Pod whose metadata.labels is nil.
2. Have a matching PodProbeMarker policy that adds a label when a probe reaches a matching state.
3. Let NodePodProbe update the Pod from that probe state.

The controller can panic when it writes the marker label into the nil labels map.

Anything else we need to know?:

A small guard before applying marker labels should be enough:

if podClone.Labels == nil {
    podClone.Labels = map[string]string{}
}

A regression test can cover a Pod with nil labels plus a marker policy that adds a label.

Environment:

• Kruise version: master
• Kubernetes version (use kubectl version): N/A
• Install details (e.g. helm install args): N/A
• Others: Found by code inspection