feat: add explicit-context per-resource operations

[gnanirahulnutakki]

Summary

• add a source-neutral local-operation boundary for describe/YAML, logs, exec, port-forward, and server-validated YAML apply
• expose explicit-context CLI commands and cache-row TUI actions while keeping all local operations outside Intent/PEP/governed execution
• default-mask Secrets, require dry-run/diff before edit, restrict port-forward to loopback, and bootstrap only the selected kubeconfig context
• extend the pinned real two-kind-cluster gate with context-isolated logs, exec, YAML/Secret, describe/events, edit persistence, and live TCP forwarding

Safety and architecture

• uses the user's existing kubeconfig identity directly
• no account, telemetry, persistence, or egress beyond the selected Kubernetes API
• local exec preserves argv and never invokes a shell
• YAML edit uses a 0600 bounded temporary file and strict server dry-run before apply
• AST boundary test rejects local-operation imports of the governed connector/Intent/PEP path

Verification

• go test -race -count=1 ./...
• go vet ./...
• golangci-lint run ./... (0 issues)
• golangci-lint fmt --diff ./...
• govulncheck ./... (no vulnerabilities found)
• go mod verify
• tagged binary e2e smoke test
• warm-cache TUI p95 test
• digest-pinned two-cluster kind gate: PASS in 65.72s
• GitHub Dependabot, CodeQL, and secret-scanning open alerts: zero

Closes #35