Update transform&apply for cluster-level resources

[aufi]

Context

Follow-up to #186. Depends on #188 and #256 being completed first.

Cluster-scoped resources (ClusterRole, ClusterRoleBinding, CRDs, etc.)
exported by crane export are currently not fully supported through the
transform and apply stages. This issue tracks making them first-class
citizens in the full pipeline.

Goal

Ensure cluster-scoped resources pass through export → transform → apply
correctly: handled by transform plugins, rendered by kustomize, and written
to a deterministic output layout that separates them from namespaced resources.

Functional requirements

1. Cluster-scoped resources from export must be consumed by transform — not
   skipped, misclassified, or assigned a fake namespace like default
2. Transform plugins (especially KubernetesPlugin) must handle resources
   with empty metadata.namespace correctly
3. Generated patch targets for cluster-scoped resources must omit namespace
4. crane apply must place cluster-scoped resources under
   output/resources/_cluster/ and namespaced resources under
   output/resources/<namespace>/
5. kubectl kustomize must succeed on every produced stage with mixed
   namespaced + cluster-scoped inputs
6. Whiteout and patch filtering logic must work for cluster-scoped resources
7. Filenames and paths must be deterministic across reruns
8. Recursive kubectl apply -R -f output/ must work for the produced layout
9. crane apply must support a --skip-cluster-scoped flag that excludes
   cluster-scoped resources from the rendered output (for non-admin migration
   scenarios where the user cannot apply cluster-level objects)

Acceptance criteria

• ClusterRole, ClusterRoleBinding, and CRD resources survive
  transform and appear in output/resources/_cluster/
• Namespaced resources remain under output/resources/<namespace>/
• --skip-cluster-scoped flag omits cluster-scoped resources from output
• Patch target generation for cluster-scoped resources omits namespace
• Recursive apply of output works for mixed namespaced + cluster-scoped cases
• Unit tests: transform writer with cluster-scoped resources
• Unit tests: apply split-output layout for cluster-scoped resources
• Unit/integration test: mixed namespaced + cluster-scoped pipeline
• E2E test: at least one scenario proving cluster-scoped dependency
  migration works end to end

[github-actions]

This issue is currently awaiting triage.
If contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members by writing /triage accepted in a comment.

[stillalearner]

migtools/crane-lib#134