feat(k8s): kind cluster with Traefik and cert-manager for the ACME lab test

[Bugs5382]

Summary

The lab box has no Kubernetes, so the real-hardware ACME test (cert-manager getting a certificate from a CryptOS Intermediate) had nowhere to run. This adds k8s/: tasks that stand up a pinned single-node kind cluster with Traefik, cert-manager and traefik/whoami, point cert-manager at an Intermediate, verify the served chain, renew and tear down.

Closes #4

Changes

• task k8s:up: kind cluster (kindest/node by digest) publishing ports 80 and 443, Traefik chart rendered with helm template (IngressClass traefik, NodePorts mapped by kind), cert-manager manifest, whoami by digest behind a catch-all Ingress, then an HTTP smoke test. Each manifest is applied server-side only when kubectl diff reports a change, so a re-run changes nothing.
• task k8s:issuer ACME_URL=... CA_BUNDLE=... HOST=...: ACME ClusterIssuer with the CryptOS root as caBundle, http01.ingress.ingressClassName: traefik, and an optional External Account Binding (CryptOS requires one unless the node sets allow_anonymous_accounts). The HMAC goes into a Secret through process substitution and is never logged. Also creates a Certificate for HOST (ECDSA P-384, rotationPolicy: Always) and a TLS Ingress.
• task k8s:verify: waits for Ready (and dumps the Certificate, Order and Challenge state if it doesn't get there), reads the served chain with openssl s_client, and checks that it verifies to the root (-purpose sslserver), names HOST, has a P-384 key and matches the issued secret. Then prints the serial.
• task k8s:renew: cmctl renew, waits for a new serial, re-verifies. task k8s:down: kind delete cluster (a no-op when there is none).
• Pins: k8s/versions.env holds every version, digest and checksum (kind v0.33.0, node v1.37.0, kubectl v1.37.1, helm v3.22.0, cmctl v2.6.1, cert-manager v1.21.2, Traefik chart 41.6.0, whoami v1.12.0). The tools download into .tools/ and are checked by sha256. Nothing is piped into a shell.
• .env.example gains a k8s block with documentation values only. .tools/ and .state/ are gitignored.
• ci-k8s.yml: task k8s:check on every non-draft PR, plus a kind job that runs task k8s:up, runs it again and asserts nothing changed, then runs task k8s:down twice.
• README: the new environment and a quick start.

Kind rather than k3s: it leaves the lab box's host alone (no system service or host networking changes), tears down with one command, and runs on GitHub-hosted runners, so up, the re-run and down are proven in CI rather than only on the box.

Testing

• task k8s:check passes locally, 60 checks under bash 3.2 and 5.3: shellcheck, the pins, every task in dry-run mode, input refusal (http URL, missing or non-PEM bundle, bad host, missing host), the EAB HMAC absent from output and manifests, kubeconform -strict on whoami, the ClusterIssuer and Certificate (schemas found, none skipped) and the Traefik render, and check_chain against a throwaway P-384 hierarchy (accepts leaf plus intermediate; refuses a missing intermediate, the wrong root, the wrong SAN and an RSA 2048 leaf).
• Every pinned URL and checksum was downloaded and verified for linux amd64 and arm64, including the tarball member paths. A second install is a no-op.
• actionlint is clean.

Not tested yet

• k8s:up, its re-run and k8s:down against real Docker: the Mac has none. The CI kind job covers them on this PR.
• k8s:issuer, k8s:verify and k8s:renew against a real CryptOS Intermediate: they need the lab box, with DNS for HOST and the node reaching port 80.

Docs

The README is updated. No docs-site change: lab tooling isn't part of the product docs.

[Bugs5382]

Closing summary: reproducible lab Kubernetes for CryptOS tests: task k8s:up creates a pinned kind cluster with Traefik, cert-manager and whoami (checksum-checked, idempotent), k8s:issuer points an ACME ClusterIssuer at a CryptOS Intermediate with the root as caBundle and a P-384 Certificate, k8s:verify/k8s:renew/k8s:down check, renew and remove it. Cluster setup is proven in CI; the ACME steps run against the real lab node. Closes #4.