Add kustomize build checks for workload targets

[jeleel-muibi]

Area
Validation or CI

Problem
The current validation script checks target wiring and placeholder hygiene, but it does not prove that each target can render with kustomize build. A target can pass path checks and still fail at render time.

Proposed change
Add an optional or CI-backed render check for cluster targets using kustomize build.

Start conservatively:

• run against clusters/onprem-smoke
• run against clusters/onprem-stage1
• decide whether clusters/onprem should be non-strict because it is the broader catalog target
• keep error output readable when rendering fails

Acceptance criteria

• Contributors can run a documented render check locally.
• CI checks at least the smoke and stage1 targets.
• The check does not require access to a live Kubernetes cluster.
• The validation output identifies which target failed.