docs: plan optional native Kubernetes execution provider

[JAORMX]

Stage: Plan / Interface (draft)

Direction

Plan a native Kubernetes execution environment provider as a separate service in this monorepo. It owns its controller, execution pods, workspace PVCs, and lifecycle. mecak8s is an optional client and remains storage-free; ADR 0048 is not superseded.

First slice: persistent blank workspace, existing filesystem tools and foreground Shell, authenticated/authorized use in an operator-controlled cluster, retained data by default, fail-closed writer takeover, and deterministic kind qualification before any optional live-model smoke. Repository bootstrap, remote project ingestion, background jobs, and isolated delegation are deferred.

Requested PR stack

• This draft plan PR targets main from plan/native-kubernetes-execution.
• The subsequent draft implementation PR will target plan/native-kubernetes-execution, not main.
• This draft-first stack is explicitly requested by the operator. Neither a merged approval baseline nor implementation completion is claimed.

Still open

The acceptance plan remains draft, with three technical specifications to author/review before dispatching affected implementation:

1. Private API, allocation transaction and ownership/reference lifecycle.
2. CRD/configuration schemas and compatibility.
3. Grant trust/rotation/revocation, termination acknowledgement and fencing proof.

Contains a new draft ADR and 7 scenarios / 28 future acceptance criteria. No runtime code is changed.

Validation

• Acceptance-plan structural checker: passed.
• Acceptance-plan checker regression fixtures: passed.
• task docs: passed (including documentation tests and strict link gate: zero broken links/anchors, orphans, ambiguous or unreachable documents).
• git diff --check: passed.
• Adversarial design review performed on the precursor draft; corrections incorporated.

No cluster was created and no provider credential was accessed. No live inference was performed.