feat: add execution templates with platform-managed identity

[JAORMX]

Summary

Implements operator-owned, revision-pinned execution templates across the Kubernetes provider, public API, mecatui, Studio, and TypeScript SDK.

• Session creation supports the deployment default, explicit no-filesystem execution, or an exact eligible template revision.
• Template discovery is authenticated. Bindings retain exact environment identity, historical definitions, and workspace PVCs across reconnects and restarts.
• Execution authorization checks the authenticated client, owner, binding, active run, epoch, lease, and operation fence against current durable state.
• Service identity comes from external PKI. Provider and client reload certificate material; valid renewal drains in-flight requests. The provider does not issue signed execution grants or manage grant-signing keys.
• Guides describe current configuration and behavior rather than the implementation history.

This is a deliberate hard cut for the unused runtime, without compatibility shims.

Refs #2109.

Verification

Local checks passed after integration with main and the CI repairs:

• Documentation validation, full Go lint and offline test suites.
• Full race suite across all modules, including the microvm_dev tagged tests.
• Studio lint, typecheck, generated-artifact checks, and server/web tests.
• TypeScript SDK lint, typecheck, and 364 tests.
• Strict govulncheck across all 12 modules, without vulnerability suppressions; Go 1.27.2 and x/net 0.60.0 are pinned.
• Tagged Kind test compilation, fixture race tests, Docker base-pin validation, and the offline permission ask/approval demo.

The pre-integration local production-profile Kind qualification passed, including authorization, isolation, template history, retained PVCs, and lifecycle fencing. Its long-running phase observed four automatic client/server certificate renewals and successful same-session work after the original certificate expired. Following integration, the repaired in-flight renewal test also passed against real local Kind with the reloadable client and a preserved terminal result. Current-head CI runs the complete production profile and both long-renewal tests.

Before the main integration, a real OpenRouter model was exercised through the shipping mecatui in a PTY: select a remote template, build a Go JSONL log-summary CLI, request a follow-up feature, approve individual Edit/Shell operations, run all 14 project tests, exercise the CLI, and disconnect/resume the same session and workspace. This was fresh UI/model interaction, not replayed qualification evidence. That paid-model TUI journey has not been repeated after integration.

Draft review notes and remaining coverage

• The real-model journey hit its cumulative token ceiling after the verification tools completed. It did not produce a final model-written report, and a fresh post-resume model response was not tested in that TUI journey.
• Authentication used a synthetic local OIDC identity. Real browser sign-in and an end-to-end Studio journey remain untested.
• Studio now builds against the checked-out SDK using the repository-root image context. That build/release coupling needs explicit review.
• cert-manager is a fixture integration, not a mandatory runtime dependency. Its local bootstrap CA has a fourteen-day lifetime; platform issuer/root and trust lifecycle management remain operator responsibilities.
• Passing local qualification is not a production-readiness claim.