[chrischeng-c4]

Closes #19

Summary of Changes

• Added ServiceAccountIdentityPlan in crates/service-k8s/src/infrastructure/manifest/workload_plan/service_account_identity.rs:
  • Implements new(name, component), with_annotation(key, value), with_workload_identity(gcp_service_account_email), and try_with_workload_identity.
  • Exposes getters for name, component, annotations, automount_service_account_token (fixed to false), and workload_identity.
  • Renders metadata.annotations only when at least one annotation is present; otherwise output matches ServiceAccountPlan.
  • Validates that the GCP Workload Identity email matches <name>@<project>.iam.gserviceaccount.com (rejecting empty or malformed strings with WorkloadPlanError::InvalidWorkloadIdentity).
• Extended WorkloadPlan in crates/service-k8s/src/infrastructure/manifest/workload_plan.rs:
  • Added ServiceAccountIdentity(ServiceAccountIdentityPlan) to PlannedObject.
  • Added add_service_account_identity.
  • Added WorkloadPlanError::InvalidWorkloadIdentity(String, String).
  • Updated render to render PlannedObject::ServiceAccountIdentity.
• Re-exported ServiceAccountIdentityPlan and ProjectedServiceAccountToken in crates/service-k8s/src/api/render.rs and crates/service-k8s/src/api/render::workload_plan.
• Added isolated unit test rows in crates/service-k8s/tests/it/workload_plan.rs:
  • typed_plan_renders_identity_separated_backup_and_restore_service_accounts: verifies distinct backup and restore KSAs with Workload Identity annotations, bound to disjoint Roles with disjoint RBAC rules.
  • typed_plan_renders_pod_with_projected_service_account_token_and_no_secret_volume: verifies pod mounting ProjectedServiceAccountToken with caller audience, expirationSeconds >= 600, and no Secret volume.
  • service_account_identity_without_annotations_omits_annotations_key_and_equals_service_account_plan: verifies absence of annotations key when none configured and exact equality to ServiceAccountPlan.
  • service_account_identity_rejects_empty_or_invalid_workload_identity_shape: verifies rejection of empty string, missing @, wrong domain, empty name, and empty project across render and builder.

Tests Passed (Local Affected Isolated Unit Tests)

• cargo test --locked -p service-k8s --test it workload_plan (9 passed, 0 failed)
• rustfmt --check on modified files

Tests Not Run Locally (Awaiting Cloud MR CI)

• Crate-wide and workspace-wide full test suites (not run locally per affected-unit-only policy).
• Functional/e2e tests, server/cluster integration tests, and performance benchmarks belong in authorized cloud CI.