feat(framework): Add k3d harness infra proof

[msheller]

Issue

Description

This PR is F7b in the Kubernetes executor rollout stack. F7a introduced the portable evidence bundle/schema scaffold for a future integrated k3d launch-path harness. The next slice needs a local, optional way to prove the Kubernetes infrastructure assumptions for that future harness without yet running the full SuperLink AppIo, SuperExec, and TaskExecutor path.

Related issues/PRs

Stacked on #7383.

Proposal

Explanation

This PR extends the dev-maintained Kubernetes executor harness with an explicit infra-proof mode. The mode records k3d infrastructure, namespace, TLS material contract, and RBAC proof evidence through the F7a evidence bundle format.

Host commands are dry-run by default. Real k3d/kubectl execution requires --execute, and local cluster creation is additionally gated behind --create-cluster. The harness can render/apply namespace and SuperExec ServiceAccount/Role/RoleBinding manifests, run positive and negative kubectl auth can-i checks, and record sanitized command evidence. TLS certificate generation is intentionally deferred; this slice records a supplied AppIo root certificate path/fingerprint or marks TLS material as planned.

This does not implement the full integrated launch path. SuperLink AppIo, SuperExec task claiming, TaskExecutor Pod launch, capacity wait proof, cleanup proof, and CNI/NetworkPolicy validation remain future F7 work.

Checklist

• Implement proposed change
• Write tests
• Update documentation
• Address LLM-reviewer comments, if applicable (e.g., GitHub Copilot)
• Make CI checks pass
• Ping maintainers on Slack (channel #contributions)

Any other comments?

Validation run locally:

• python -m py_compile framework/dev/kubernetes_executor_harness.py framework/py/flwr/supercore/superexec/executor/kubernetes_executor_harness_test.py
• python -m pytest framework/py/flwr/supercore/superexec/executor/kubernetes_executor_harness_test.py
• git diff --check
• python -m black --check framework/dev/kubernetes_executor_harness.py framework/py/flwr/supercore/superexec/executor/kubernetes_executor_harness_test.py
• python -m ruff check --no-cache framework/py/flwr/supercore/superexec/executor/kubernetes_executor_harness_test.py

Optional real proof was run by the implementation thread:

python framework/dev/kubernetes_executor_harness.py --mode infra-proof --output-dir /private/tmp/f7b-harness-real-2 --execute --create-cluster --apply-manifests --json

Result: passed. The local k3d cluster flower-f7 was left in place for inspection.