Support fully-private GKE clusters and configurable proxy pod readiness timeout

[likewei92]

Summary

Two improvements to the Shared Pathways Service ISC (Interactive Single Controller)
connection flow to better support real-world GKE cluster configurations.

Changes

1. Make --dns-endpoint optional for fully-private clusters

fetch_cluster_credentials previously always passed --dns-endpoint to
gcloud container clusters get-credentials. This breaks on fully-private
clusters whose DNS and public endpoints are both disabled.

• Added a use_dns_endpoint parameter (default True) to
  fetch_cluster_credentials, threaded through isc_pathways.connect().
• Added a --use_dns_endpoint flag to start_vscode_on_cpu_np.py.
• When set to False, credentials are fetched via the reachable private IP
  endpoint instead.

2. Make proxy pod readiness timeout configurable

The proxy pod wait used kubectl's short default timeout, which could expire while
a node cold-starts from zero (cluster autoscaling + image pull).

• Added DEFAULT_POD_READY_TIMEOUT_S (60s) in gke_utils.
• wait_for_pod now accepts a timeout parameter.
• Exposed proxy_pod_ready_timeout_s on isc_pathways.connect() so callers can
  increase the wait for pools that autoscale from zero.

Files Changed

• gke_utils.py — new timeout constant, use_dns_endpoint and timeout params
• isc_pathways.py — plumb both new options through connect()
• start_vscode_on_cpu_np.py — new --use_dns_endpoint flag