feat(session): manage KAP mTLS agent credentials

[cardyok]

Summary

• keep only the KAP mTLS status and credential-update session commands; kubeconfig is now fixed during Lepton bootstrap
• validate each per-machine certificate, identity, endpoint, and CA fingerprint before writing an immutable credential generation
• atomically switch the current symlink, restart the agent, and acknowledge the update only after /readyz succeeds
• remove enable/disable state, kubeconfig mutation, pending markers, nested TLS preflight, and automatic rollback
• keep certificate and private-key material redacted from session audit logs

Rollout

• the companion Lepton MR dgxc-lepton/lepton!7510 installs the agent by default on new nodes and points kubelet at loopback from bootstrap
• existing nodes are not backfilled; Lepton reconciles only Machines that report the kap-mtls-agent package
• release this gpud change before or with the Lepton node-init rollout; failures leave new nodes blocked before kubelet registration

Verification

• GOFLAGS=-mod=mod go test -count=1 ./pkg/kapmtls
• GOFLAGS=-mod=mod go test -count=1 -gcflags='all=-N -l' ./pkg/session
• GOFLAGS=-mod=mod go test -race ./pkg/kapmtls
• GOFLAGS=-mod=mod go vet ./pkg/kapmtls ./pkg/session

The repository-wide default pkg/session test command requires Mockey's -gcflags='all=-N -l' on macOS/arm64; the changed package scope passes with that required flag.

Jira: LEP-5336

[codecov]

Codecov Report

❌ Patch coverage is 95.30988% with 28 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.66%. Comparing base (c15cb49) to head (695d996).

Files with missing lines	Patch %	Lines
pkg/kapmtls/manager.go	94.73%	13 Missing and 11 partials ⚠️
pkg/login/login.go	33.33%	1 Missing and 1 partial ⚠️
pkg/server/server.go	86.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1264      +/-   ##
==========================================
+ Coverage   90.59%   90.66%   +0.06%     
==========================================
  Files         349      351       +2     
  Lines       26429    26997     +568     
==========================================
+ Hits        23944    24477     +533     
- Misses       1685     1708      +23     
- Partials      800      812      +12     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[eahydra]

P1 — Failed activation is reported as successfully applied. UpdateCredentials switches current before enabling/restarting the service. If restart fails while the old agent remains alive, subsequent Status reports the new on-disk credentials together with AgentActive=true and AgentReady=true. The reconciler therefore considers the desired generation installed, although the running process still uses the old certificate/CA/endpoint. I reproduced this state. Track an applied generation only after readiness, roll back the symlink on activation failure, or verify the running certificate serial.

[eahydra]

defer to @gyuho