feat: add Kubernetes backend (#1260)

Adds a Kubernetes backend. A `name:kubernetes://image` label runs the job as one pod through the Kubernetes API, with services as containers of the same pod. Step env is exported by a script sent over exec stdin, keeping it out of the pod spec and process arguments, and service env goes into a per-job Secret. Docker actions and container options are rejected. See `docs/kubernetes.md`.

Operators shape job pods with `kubernetes.pod_template`, with per-label `pod_templates` merged in `runs-on` order and a `$services` entry for service containers. The idle cleanup removes pods and Secrets a runner left behind.

The client calls the Kubernetes API directly and runs step commands over `coder/websocket` (same dependency used in gitea) instead of pulling in the heavyweight `kubernetes/client-go`. Includes an e2e test against k3s.

Replaces: https://gitea.com/gitea/runner/pulls/1000
Fixes: https://gitea.com/gitea/runner/issues/31

Assisted-by: Claude Code:claude-opus-5-5
Co-authored-by: Zettat123 <[email protected]>
Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1260
Reviewed-by: Lunny Xiao <[email protected]>
Reviewed-by: Zettat123 <[email protected]>
Co-authored-by: silverwind <[email protected]>

tools/test-e2e.sh

@@ -4,10 +4,12 @@ set -euo pipefail
 : "${E2E_CONCURRENCY:?E2E_CONCURRENCY is required}"
 : "${E2E_JOB_IMAGE:?E2E_JOB_IMAGE is required}"
 : "${E2E_GITEA_IMAGE:?E2E_GITEA_IMAGE is required}"
+: "${E2E_K3S_IMAGE:?E2E_K3S_IMAGE is required}"
 : "${SERVICE_IMAGE:?SERVICE_IMAGE is required}"
 
 docker pull "$E2E_JOB_IMAGE"
 docker pull "$SERVICE_IMAGE"
 docker pull "$E2E_GITEA_IMAGE"
+docker pull "$E2E_K3S_IMAGE"
 
 exec "${GO:-go}" test -tags e2e -count=1 -parallel "$E2E_CONCURRENCY" -timeout 20m -v ./e2e/...