feat: add runtime image cache content

[MaxRink]

Summary

• add runtime-cache inventory queries to the Kubernetes inventory querypack
• add a preview Mondoo Kubernetes Runtime Image Cache policy for runtime delegate readiness, no-pull/read-only behavior, pod image matching, completed scan status, and immutable image identity
• add focused bundle compile coverage for the new policy and querypack entries
• update the runtime-cache content implementation plan

Review fixes

• rewrite check audits to use kubectl-native verification steps
• convert Kubernetes remediations to kubectl, manifest, and helm entries per content authoring guidance
• align runtime-cache remediation examples with the current containerd-only operator/MQL implementation
• add a dedicated control for matched running pod images whose runtime-cache scan status is not scanned
• remove the local personal-fork MQL replace and restore official module checksums
• scope the delegates-no-pull query to schedulable nodes, matching delegates-ready
• convert Why this matters sections to the expected bullet style
• update the generated network provider schema fixture to cnquery/v13
• collapse duplicated schema fixture path helpers in bundle tests
• remove the explicit os provider requirement after confirming bundle compilation succeeds with the k8s schema dependency

Dependency

This content depends on the runtime-cache MQL provider schema from mondoohq/mql#8452.

Validation

• git diff --check
• go test ./content -run TestRuntimeImageCacheContent
• go test ./content

[mondoo-code-review]

New Kubernetes runtime image cache policy adds security checks for node-local image scanning coverage.

[mondoo-code-review]

New Kubernetes runtime image cache policy adds security checks for node-local image scanning coverage.

[mondoo-code-review]

New Kubernetes runtime image cache policy adds five security checks for node-local image scanning coverage.