feat: draft native Kubernetes execution provider

[JAORMX]

Stage: production-completion repairs (draft, existing stack)

Plan: #1579 (plan/native-kubernetes-execution), docs/acceptance/native-kubernetes-execution.md, draft ADR 0350. Existing PRs only; no additional PRs and no merge. Draft development does not imply human contract approval or production readiness.

Current implementation head: 19097d3674dc1dc6c1b8d0ac82169705da9b9deb.

Implemented repairs

• Distinct administratorFor operations identities with creator-scoped authorization on all admin paths; no implicit data-plane/owner-attestation privilege.
• Continuing rate-limited PVC/Pod provisioning recovery, meaningful autonomous quota recovery tests, and bounded quota-accounting fixture readiness.
• Retained Helm network policies, configuration, security high-water and capacity state; safe same-release/namespace adoption and quiesced upgrade checks.
• Exact migration receipts including source-schema presence, receipt expiry on replacement, and fail-closed changed-input replay.
• Multi-controller retained-deletion finalizer race repaired with UID/resourceVersion guards. Holder-loss qualification now initiates exact Pod termination independently of executor descendant cleanup.
• Immutable rotation material staging and narrowly classified read-only convergence; deterministic tests reproduce replica lag and mixed-material poisoning without claiming either caused a historical timeout.
• Real remote filesystem/tool conformance, grant authorization, physical confinement, CAS behavior, bounded UTF-8 output and honest truncation.
• Host-project skill/command/Git exclusion while preserving operator-global instructions and, importantly, configured global/explicit-file Deny and Ask permissions under remote auto posture.
• Existing live workflow extended with a manual-only, exact-SHA native qualification job; deterministic prerequisite, trusted runtime credential loader, bounded stages, recorded ownership, UID-safe cleanup and allowlisted artifacts. Docker/retained-image alias and Helm tag/digest handoff fixes included.
• User guidance, lifecycle inventory, readiness tracker, and 32-AC source-backed proof map updated. Current main and fix(ci): repair live compaction slot and module metadata #1728 are integrated.

Verification completed

Normal latest-head PR workflows passed: 31 checks succeeded, 8 skipped (excluding the separate failed explicit manual qualification described below). Analysis/actionlint is green. Draft full-race/macOS lanes remain skipped.

Native production Kind+Calico job passed on the PR merge candidate. Production also passed in the exact-head manual job. The unfiltered production suite exercises all 11 scenarios, including scoped administration, rotation/revocation, replicas, migration, quotas, holder loss, Clear/Fork, retention/Helm lifecycle and bounded failure artifacts. General remote tool qualification passed too.

Full local lint/test (race and standalone modules), build, API, docs/site, offline demo and strict trace passed during the repair iterations; subsequent script-only fixes passed targeted race/fake-CLI/chart/actionlint checks. Native tracing resolves all 32 AC proof names; this is not a substitute for live evidence or human acceptance.

Independent Spec, Standards, Test Adequacy, Security, Kubernetes, Architecture, Reuse, UX and DevEx reviews and scoped follow-ups drove the repairs. No final human approval is claimed.

Remaining native-live blocker — not shippable yet

Manual run 35669238058 checked out exact head 19097d3674dc1dc6c1b8d0ac82169705da9b9deb. Production, mock preflight, credential staging and real-provider rollout succeeded. TestKindExecutionLiveQualification then timed out after 480 seconds at POST /v1/sessions, before its model prompt. No model Write, exact successful go test ./..., independent live artifact verification, or positive native usage was observed. No live summary was produced.

The underlying creation stall is unresolved. Source tracing identifies storage probing and remote Ensure/Attach readiness as possible waiting stages, but does not establish the cause. Context-window admission is a run-entry gate, not this create path. Next step is bounded, sanitized create-stage/placement diagnostics; do not increase the timeout or retry unchanged and call that a repair.

Cleanup succeeded: mock harness restored, run-owned Secret deleted with UID precondition, private credential file removed, and the exact owned cluster deleted. The allowlisted status artifact records production=success, credential=success, live=failure, cleanup=success. No credential bytes were read into model/tool context or artifacts.

Both existing PRs remain draft. Human API/schema/security/release decisions and required native live qualification remain outstanding. No production-ready or merge-ready claim.