test: apply, refresh, and tear down the Kubernetes resources in the nemoclaw contract tests

[cv]

Part of #12876. Closes #12879.

Failure

The nemoclaw provider's contract binary checked nemoclaw_kubernetes_storage, nemoclaw_kubernetes_auth, and nemoclaw_kubernetes_gateway only through plan (kubernetes_hcl). Apply, refresh, and teardown ran only in the live Kind suite.

Decision

• The provider reaches the cluster only through kube-rs: get, create, and delete by UID precondition, a StorageClass list, and a metadata list of Helm release Secrets. It never runs Helm; the bundle's Helm provider installs the chart. The SDK tests already had an in-memory Kubernetes API that covers these calls (helm_recovery runs the bundled Helm provider against it too). This PR moves that fake to crates/test-support/kube_api.rs so the provider contract binary can include it. It is shared as a source module, like http.rs, and not through nemoclaw-test-fixtures, because that crate depends on the SDK. The kube-rs client helper stays in the SDK tests (tests/support/kube_client.rs), so the provider takes no kube dependency.
• New kubernetes_lifecycle contract tests run the production provider through pinned OpenTofu. The provider connects through a kubeconfig that points at the fake and uses NEMOCLAW_KUBERNETES_STATE. The test writes and deletes the StatefulSet and release record that Helm would, in the bundle's order. The live Kind tests remain the end-to-end check of the chart.
  • kubernetes_resources_apply_observe_the_release_and_tear_down_keeping_storage:
    • Planning changes nothing.
    • Apply creates the namespace, key, and six issuer objects with the owner label and records their UIDs.
    • A gateway that is not ready plans another observation, then reports running once ready, and release_present follows the release record.
    • Teardown (destroy = true) keeps the issuer while the release exists, then deletes it once Helm's objects are gone. The namespace and key are kept.
    • tofu destroy refuses storage.
    • A later apply prepares a new issuer in the retained storage.
  • kubernetes_resources_refuse_replaced_or_missing_objects_without_recreating_them: a deleted namespace, a replaced key, a deleted or replaced issuer object, or a replaced StatefulSet fails plan and apply with the ownership error. Nothing is recreated or removed, and state is unchanged.
• Fake fix: a GET for an absent object whose name ends in s (such as namespace agents) returned 200 with an empty list instead of 404. The fake now tells collection paths from object paths by their shape. the_in_memory_api_reports_absent_objects_as_missing covers the fix.
• docs/contributing/integration-tests.md describes the new tests. It also drops the claim that ELSEWHERE lists types, because that list is now empty.

Validation

Run locally on linux_arm64:

• the_in_memory_api_reports_absent_objects_as_missing failed before the fake fix and passes after it.
• Both kubernetes_lifecycle tests pass in about 6 s each with pinned OpenTofu 1.12.6. kubernetes_hcl and every_type_has_a_contract_test also pass.
• Mutation check: with storage verification disabled in Operations::read_storage, the drift test fails at the deleted namespace. I reverted the mutation.
• All 85 SDK kubernetes_ integration tests pass, plus the helm_recovery lib tests, including the five ignored ones against a bundle.
• cargo fmt --all and cargo clippy --workspace --all-targets -- -D warnings pass.

I did not run Windows locally. The tests reach the fake over loopback TCP, not through the ssh relay, and are not gated.

[github-actions]

v1 documentation preview: https://nvidia-preview-nemoclaw-v1-pr-12972.docs.buildwithfern.com/nemoclaw