ci: add Kubernetes static qualification canary

.woodpecker/k8s-static-canary.yml

@@ -0,0 +1,53 @@
+# Manual-only canary for the Kubernetes + Kueue Woodpecker execution pool.
+#
+# The existing .woodpecker/ci.yml remains the authoritative fallback lane on
+# bootstrap-ci. This canary exercises only static verification so runner and
+# repository failures remain attributable during qualification.
+
+labels:
+  platform: linux/amd64
+  pool: k8s-ci
+
+when:
+  - event: manual
+
+concurrency:
+  limit: 1
+  group: dev-plane-k8s-static-canary
+
+steps:
+  - name: static
+    image: node:24-bookworm
+    environment:
+      GO_VERSION: "1.26.8"
+      GOLANGCI_LINT_VERSION: "v2.13.2"
+    commands:
+      - set -eux
+      - actual_head="$(git rev-parse HEAD)"
+      - test "$actual_head" = "$CI_COMMIT_SHA"
+      - echo "validated exact k8s-ci head $actual_head"
+      - apt-get update
+      - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates curl git make
+      - curl -fsSLo /tmp/go.tgz "https://go.dev/dl/go$GO_VERSION.linux-amd64.tar.gz"
+      - rm -rf /usr/local/go
+      - tar -C /usr/local -xzf /tmp/go.tgz
+      - export PATH="/usr/local/go/bin:/root/go/bin:$PATH"
+      - go version
+      - node --version
+      - npm --version
+      - go install "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$GOLANGCI_LINT_VERSION"
+      - cd apps/web && npm ci && cd ../..
+      - make lint-go
+      - make lint-web
+      - cd apps/web && npm run typecheck && cd ../..
+      - make lint-sdk
+      - git diff --check
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            cpu: "2"
+            memory: 4Gi
+          limits:
+            cpu: "4"
+            memory: 7Gi