feat(k8s): Kubernetes backend provider crate

The provider binary behind the remote-agents spec's Kubernetes binding
(`docs/remote-agents.md` §K8s). One process per operation: one JSON
object in on stdin, one JSON object out on stdout, exit 0 for any
response that was produced. `info` and `deploy`; kube-rs against an
ambient kubeconfig only, so no credential ever appears in
`provider_config` (I2).

The §Deploy State Machine is implemented row by row against a
`Substrate` trait, with the real kube-rs implementor in `cluster.rs`
and a scripted fake driving the shipped `deploy` in tests. Three
mechanisms are normative rather than incidental and are spelled once
each: quorum reads with `resourceVersion` left unset, UID +
`resourceVersion` delete preconditions, and `Status.reason` as the 409
discriminator — `code == 409` appears nowhere in the crate, because
`AlreadyExists` and `Conflict` share it and conflating them takes the
adoption path on a failed delete (`:763-765`).

Secrets are per-attempt, immutable, and uniquely named, which makes
payload and Secret atomic at the pod-spec boundary without a Lease.
GC never touches an object lacking the management marker, and its
orphan sweep is skipped entirely when the apiserver's `Date` header is
absent — a fast local clock must not be able to delete an in-flight
Secret.

144 tests. The fake substrate carries a fake clock, which turned two
hot-spin bugs in the reconcile loop from unreproducible hangs into
instant failures. Per-MUST coverage, including what is deliberately out
of scope with its citation, is in the PR body.

Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>

scripts/run-tests.sh

@@ -106,6 +106,12 @@ run_unit_tests() {
 
   run_test_step "buzz-push-gateway tests" \
     cargo test -p buzz-push-gateway -- --nocapture
+
+  # Kubernetes backend provider: pure decision layers driven by a fake
+  # substrate, no cluster. Mirrors the nextest path in `just test-unit` —
+  # the two lists must stay in step or the fallback silently covers less.
+  run_test_step "buzz-backend-kubernetes tests" \
+    cargo test -p buzz-backend-kubernetes -- --nocapture
 }
 
 # ---- DB / integration tests (infra required) --------------------------------