Vendor k8s label selection, remove apimachinery fork

[xenoscopic]

Summary

Vendor the subset of k8s.io/apimachinery used for Kubernetes-style
label selection into pkg/selection/internal/third_party/apimachinery/,
eliminating the mutagen-io/apimachinery fork and its replace
directive in go.mod.

The fork existed solely to strip the klog dependency, which bloated
agent binaries and spawned goroutines on init(). By vendoring only the
packages Mutagen actually uses, we get the same benefit permanently
without maintaining a fork.

Originally extracted from kubernetes/apimachinery at
f916759cb6b8
(tag v0.21.3), via mutagen-io/apimachinery v0.21.3-mutagen1.

Commit structure

1. test: expand label selection test coverage -- 56 new tests
   for pkg/selection public API (parsing, matching, key/value
   validation, key extraction). Runs against the fork to establish
   baseline.
2. deps: vendor k8s label selection, remove apimachinery fork --
   Vendored code + original k8s test files. Same tests pass against
   vendored code.

Vendored packages

Package	Source + Tests	Purpose
labels	4 + 2 files	Selector parsing and label matching
selection	1 file	Operator enum
util/errors	1 file	Aggregate error type
util/sets	3 files	String set (other types omitted)
util/validation	1 + 1 files	Name and label value validation
util/validation/field	2 + 2 files	Error types and field paths

Each file carries the full Apache 2.0 license header and extraction
provenance, following the existing pattern in
pkg/filesystem/watching/internal/third_party/.

What's removed

• k8s.io/apimachinery require line from go.mod
• replace k8s.io/apimachinery => github.com/mutagen-io/apimachinery
• 187 lines of transitive k8s dependency hashes from go.sum

Test plan

• go test ./pkg/selection/... passes (56 Mutagen-level tests +
  vendored k8s tests for labels, validation, and field packages)
• go build ./cmd/... ./pkg/... passes
• go vet ./cmd/... ./pkg/... passes clean
• CI passes on all platforms