feat: mount the quota credential as cert files plus a static kubeconfig

Change the compute-manager quota-credentials volume from a single opaque
secret to a projected volume that combines the Milo client certificate
(compute-edge-milo-client-cert) with a static kubeconfig ConfigMap
(compute-quota-kubeconfig), both supplied by the cluster environment.

compute-manager now loads a kubeconfig that references the mounted cert
files by path instead of one with the client key embedded, so cert
rotation is a plain file refresh and no secret carries an assembled
kubeconfig. Both sources are optional, so the manager still starts where
quota is not wired.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: scotwells

config/components/quota-credentials/kustomization.yaml

@@ -1,3 +1,9 @@
+# Mounts the quota credential for compute-manager at /etc/quota-credentials:
+# the Milo client certificate (ca.crt/tls.crt/tls.key) and a static kubeconfig
+# that references those cert files by path, combined into one directory via a
+# projected volume. The cluster environment supplies both sources
+# (compute-edge-milo-client-cert Secret + compute-quota-kubeconfig ConfigMap);
+# they are optional so compute-manager still starts where quota is not wired.
 apiVersion: kustomize.config.k8s.io/v1alpha1
 kind: Component
 
@@ -21,6 +27,11 @@ patches:
                     readOnly: true
             volumes:
               - name: quota-credentials
-                secret:
-                  secretName: compute-quota-credentials
-                  optional: true
+                projected:
+                  sources:
+                    - secret:
+                        name: compute-edge-milo-client-cert
+                        optional: true
+                    - configMap:
+                        name: compute-quota-kubeconfig
+                        optional: true