Add Kubernetes integration and security CI gates

[adit-chandra]

Motivation

Catch deployment regressions and vulnerable infrastructure dependencies before merge. This is a separate CI PR based on latest main, including the merged review fixes from #2.

Changes

• Run the built supervisor and shipped Helm chart in disposable kind clusters for Kubernetes 1.30 and 1.37. Exercise install/upgrade, process handoff, admission, status conflicts, server-side apply, Secret resource-version hashing, namespace RBAC, and Lease contention.
• Add provider-aware TFLint for all three Terraform modules and examples, dependency review, Trivy dependency/secret/configuration/image scans, weekly security scans, and Dependabot updates. Render charts explicitly so missing required values cannot silently skip policy scanning.
• Pin action commits and tool versions, bound job durations, cancel superseded runs, and retain cluster failure diagnostics.
• Update vulnerable Go validator dependencies, apply OS security updates and remove build tools from the runtime image, and explicitly deny unmatched Azure storage traffic. Document two narrowly scoped policy exceptions for required controller networking permissions and the intentionally disabled Azure trusted-services bypass.
• Document required branch checks and local reproduction in CI.md. Cloud installation, identity/TLS, analyzer migration/recovery, and host-to-Dashboard acceptance remain separate release gates.

Validation

Local: 123 Python tests, Ruff, actionlint, Go CRD admission validation, TFLint for all clouds, Azure Terraform mock plans, Terraform formatting, and Trivy source/rendered configuration scans pass. All nine GitHub checks pass at 557c5ab: contracts, all three Terraform jobs, both Kubernetes jobs (four real-cluster tests each), dependency review, source security, and built-image security. Image smoke/build and real-cluster validation ran on GitHub runners because the local Docker daemon is unavailable.

Enabled this repository’s dependency graph and alerts, required for dependency review. Workflow files do not configure branch protection; CI.md lists the checks to require after their first successful run. No cloud environment or release publication workflow is invoked by these checks.