Improve container debug privilege gates

[DENGXUELIN]

Summary

• add an additive debug container and ephemeral privilege evidence gate inside the existing container-security workflow
• require workload persistence, TTL/expiry, namespace and target scope, RBAC/admission control, audit trail, and runtime-constraint evidence before downgrading privileged debug access
• add vulnerable and benign fixtures for a persistent privileged debug DaemonSet versus a scoped audited ephemeral debug container

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• Added-line ASCII check
• Content marker check for debug container, ephemeral privilege, TTL, audit evidence, RBAC gate, host namespace, privileged, and break-glass evidence
• git merge-tree --write-tree origin/main HEAD

Closes #1574

Bounty request: Improver Moderate / USD 100 if accepted.