ci: add Kubernetes static qualification canary

[dporkka]

Purpose

Add a manual static-analysis canary for the shared k8s-ci Woodpecker pool without changing Dev Plane's existing bootstrap-ci validation lane.

This PR is stacked on #136 and changes only one new manual workflow.

Behavior

• manual-only trigger;
• schedules exclusively on pool: k8s-ci;
• verifies git rev-parse HEAD == CI_COMMIT_SHA before installing toolchains;
• uses the same Node 24, Go 1.26.8, and golangci-lint v2.13.2 versions as the bootstrap lane;
• runs the repository-native static gates: Go lint/vet, web lint/typecheck, TypeScript SDK typecheck, and git diff --check;
• requests 2 CPU / 4 GiB and caps at 4 CPU / 7 GiB to fit the initial 4-vCPU/8-GiB CI nodes;
• leaves tests, NATS, builds, and required merge verification on the existing bootstrap lane.

Why static-only

The goal is to qualify Kubernetes scheduling, checkout identity, dependency/toolchain installation, repository execution, and terminal result reporting with a narrower failure surface. Once this runs reliably, a later migration can move the full existing .woodpecker/ci.yml contract rather than maintaining a second verification definition.

Safety

• ci: add self-hosted Woodpecker validation lane #136 remains the authoritative Woodpecker fallback on bootstrap-ci;
• no required status is renamed or removed;
• no Dev Plane runtime provider is changed;
• this does not switch verification to the Nulang Firecracker Workspace provider;
• do not promote this canary until the Nulang Cloud Kubernetes smoke and queue/PVC cleanup path have repeated real execution evidence.