test(coverage): drive providers/compute to ≥95% (k8s 17% -> 95.9%)

Cover the k8s compute client end-to-end with fake clientsets (no real
cluster): build-job manifest assembly, deployment/service/ingress/NetworkPolicy
create+delete, status polling (running/failed/pending), namespace
create+teardown, cert-manager TLS wiring, and every apierrors error branch
(IsNotFound / IsAlreadyExists). Adds buildImage error-path coverage, MinIO
build-context upload happy + create-bucket paths via an in-process S3 stub,
extractTarGz filesystem-error branches, and the isUnderDir traversal guards.
noop + compute root packages reach 100%.

newDynamicClient becomes a package-level var so tests can inject a fake
dynamic client for cert-manager Certificate readiness checks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805