feat(connector): add local kubeconfig fleet source

[gnanirahulnutakki]

Outcome

Implements Slice 1 for #38 and #32: the source-abstract fleet model, capability-checked seven-verb connector registry, and the first read-only local-kubeconfig adapter.

Behavior

• discovers every client-go kubeconfig context concurrently
• keeps unreachable contexts non-fatal with explicit coverage and last-seen timestamps
• honors local ExecCredential v1 helpers without persisting credentials
• supports typed read/query fan-out for the initial Kubernetes resource set
• injects the adapter through the existing fleet.Source seam so sith clusters reports real contexts
• rejects malformed references/selectors before credential or network work
• bounds probes and reads even when an underlying operation ignores context cancellation

Verification

• make ci: formatting, vet, tagged lint, govulncheck, race tests, binary e2e, build
• adapter statement coverage: 84.6%
• govulncheck v1.6.0: no reachable vulnerabilities
• real kind v0.32.0 gate: two Kubernetes v1.36.1 clusters plus one unreachable context; adapter query and built CLI both report exact 2/3 coverage
• all five commits are SSH-signed, DCO-signed, and carry sequential GSTACK-Checkpoint trailers

Supply chain and cost

• client-go/apimachinery v0.36.2 on Go 1.26
• x/net raised to v0.55.0 to remediate two reachable findings
• kind node image is digest-pinned; CI installs kind v0.32.0 from its pinned Go module version
• the real-cluster gate adds temporary Docker CPU, memory, disk, and CI runtime, then deletes the clusters

Resolves #38
Resolves #32