feat: draft native Kubernetes execution provider

[JAORMX]

Stage: production completion (draft, stacked)

Plan: #1579
Base: plan/native-kubernetes-execution
The operator requested completion of production readiness. This PR now contains the ownership, lifecycle, rotation, deployment, and qualification implementations, but production qualification is not yet complete. No merge or release publication is implied.

Implemented

• Separate optional provider service/controller in this monorepo; mecak8s is a storage-free client.
• Typed gRPC over mandatory mTLS, owner/client/environment/run/epoch/generation-bound grants, bounded admission and sanitized errors.
• Environment-wide run acquisition/renewal/release, exact lease-loss fencing, post-drain/shutdown teardown, and preserved local/no-FS behavior.
• Transactional create/successor/delete references, bounded owner-safe intent reconciliation, and conservative retention after unknown store outcomes.
• Schema-v2 CRD, explicit compatible legacy migration, safe exact-Pod termination proof, healthy replacement, recovery, two-stage retirement and UID-preconditioned retained-PVC deletion.
• Durable revocation receipts, atomic keyring/TLS/CA/policy reload, complete authority digest/high-water checks, per-request expiry enforcement, and ConfigMap-backed allocation capacity.
• RuntimeClass/StorageClass preflight, quotas, network restrictions, multi-replica controller safety, bounded health/admission, hardened image/chart release definitions, and operator runbooks.
• Calico-backed production CI/qualification, direct replica-pinned RPCs, API-server legacy-CRD upgrade fixture, exact negative-network probe outcomes, lifecycle/rotation/quota/holder-loss/Clear-Fork cases, and protected live OpenRouter runner.

Verification and current blocker

• Full task test, targeted race suites, lint/actions, build, API check, docs/site and offline demo passed during the production repair iterations. The latest migration/network fixture edits passed full tests, lint, docs and build.
• Two independent review rounds identified concrete issues; repairs include CRD admission/pruning, expired-renewal rejection, termination/retirement replay, exact intent lookup, capacity release recovery, complete security digest/expiry checks, and trusted immutable release provenance.
• Fresh production Kind reached Kubernetes/Calico readiness. The real pre-upgrade CRD/string-reference migration and failure-artifact tests passed. Allowed workload endpoint access and executor TCP denials were observed; subsequent test fixes still require rerun.
• Local production qualification is blocked by rootless kernel keyring exhaustion (kernel.keys.maxkeys=200, kernel.keys.maxbytes=20000): runc cannot create later Pod sandboxes. No host setting was changed by the agent. Operator approval for a temporary increase is pending.
• Latest CI is being monitored; the previous production CI CRD validation failure was fixed and now has full Kubernetes CRD validation coverage.
• Rotation, remaining lifecycle/quota/holder-loss/Clear-Fork cases must all execute successfully before production readiness is claimed. The full acceptance panel and final 28-AC evidence closure remain gates, not declarations.

Live credential status

A prior typed-gRPC live OpenRouter coding run passed (28,003 input / 783 output tokens, actual Write and exact go test ./... Shell exit 0, independent gRPC artifact/test verification). That is pre-production-hardening evidence, not proof of this new lifecycle implementation. The final protected live smoke is withheld until deterministic production qualification is green.

The supplied OpenRouter credential is read only by the trusted runtime loader, never directly by agent tools/model context. Only the harness receives its run-owned Secret; cleanup is UID-pinned and restores mock mode. No credential was read or staged during the blocked production run.

Scope retained

Foreground Shell and filesystem operations are supported. Git bootstrap, remote project ingestion, background/status/streaming command APIs, schedules, and isolated delegation remain explicitly outside this first production scope. Unobservable-node recovery fails closed without independent fencing proof. Cluster administrators and the selected runtime/CNI remain deployment trust assumptions.