keep: gate committed k8s/operator/crd.yaml against the generated CRD #14

Keep-only slice of #5. The other apps and the shared helper stay in #5.

Goal

The committed k8s/operator/crd.yaml must be the exact output of the Rust generator keep::operator::crd_yaml() (crates/keep-operator/src/lib.rs:28). Today no test compares them. The existing tests in crates/keep/tests/operator.rs check crd_yaml() alone, so the committed file can rot. When it rots, the API server prunes the missing fields (this is how spec.backup was dropped, see #5). Also, CI runs cargo test --locked --workspace without --features operator, so crates/keep/tests/operator.rs (#![cfg(feature = "operator")]) never runs in CI. Without the feature, keep k8s crd render prints the committed file itself (crates/keep/src/bin/keep.rs:836-839), so a gate without the feature compares the file with itself.

Acceptance

• A new test in crates/keep/tests/operator.rs asserts that the committed k8s/operator/crd.yaml is byte-equal to the generator output, with the same trailing-newline handling that keep k8s crd render uses under --features operator (cli_std::artifact::ensure_trailing_newline where needed).
• The failure message names the exact regeneration command: cargo run -p keep --features operator -- k8s crd render --out k8s/operator/crd.yaml (or the exact --out form that K8sCrdCmd::Render accepts; check it).
• If the committed file has drift now, regenerate it in the same PR with that command, and say in the PR body which fields changed.
• .github/workflows/keep-ci.yml "Run Keep gates" step also runs cargo test --locked -p keep --features operator --test operator, so the operator tests run in CI.
• Negative control: with one line of k8s/operator/crd.yaml changed locally, the new test fails with the regeneration command in its message. Report this in the PR body; do not commit the change.

Never

• Do not change KeepSpec, crates/keep-operator/src/crd.rs, or what the CRD contains, other than regenerating measured drift.
• Do not add a shared helper in faberline/core or touch other apps; that stays in CRD drift: gate rendered output against the committed crd.yaml (keep's spec.backup was silently pruned in-cluster) #5.
• Do not run anything against a real cluster. CRD drift: gate rendered output against the committed crd.yaml (keep's spec.backup was silently pruned in-cluster) #5 AC4 (real apply that produces the backup CronJob) stays open in CRD drift: gate rendered output against the committed crd.yaml (keep's spec.backup was silently pruned in-cluster) #5.
• Do not change the Dockerfile render tests in crates/keep/tests/deploy_cli.rs.

Gate

cargo fmt --all -- --check
cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
cargo test --locked -p keep --features operator --test operator
cargo test --locked --workspace