[CI] Modernize and harden Agent Stack Kubernetes installer - #441

Summary

Source review found that the Kubernetes installer was stale. Against the tested Buildkite Agent Stack chart, it passes invalid config.org, does not select a queue (and therefore targets the default queue), floats the chart version, and still requires obsolete GraphQL configuration.

This change:

• pins the tested agent-stack-k8s chart default to 0.46.3;
• requires an explicit BUILDKITE_AGENT_QUEUE (b200-k8s for the B200 queue);
• removes invalid config.org and obsolete GraphQL settings;
• makes Helm upgrades atomic, waited, and bounded by a 10-minute timeout; and
• adds a checked-in values baseline for controller requests, completion/reservation timeouts, and Prometheus scrape annotations.

Validation

• bash -n infra-k8s/install-buildkite-k8s.sh
• ShellCheck using koalaman/shellcheck:stable
• git diff --check
• Helm render using alpine/helm:3.19.0, chart 0.46.3, a dummy token, and BUILDKITE_AGENT_QUEUE=b200-k8s; verified the queue, metrics annotations, controller image, and resource requests
• Parsed the rendered ConfigMap with the official 0.46.3 controller image; configuration loading succeeded and stopped only at the expected missing in-cluster Kubernetes environment

⚠️ Pre-merge checklist for Kevin/operators

• Capture live helm get values and helm get manifest, then compare them with this render so existing deployment-specific settings are preserved.
• Confirm the target cluster satisfies the chart's Kubernetes >=1.29.0-0 requirement and confirm the cluster agent token is correct.
• Confirm the exact queue name; use b200-k8s for B200.
• Exercise upgrade and rollback in an appropriate nonproduction or otherwise controlled deployment before touching production.

Non-goals

No live cluster was accessed. This does not provide or claim control-plane HA. It does not add storage limits without measurements.

No overlapping open PR was found for the installer/Agent Stack/B200 reliability searches.