ci: adopt Kubernetes boundary audit and mutation checks - #1056

CI's cloud/Kubernetes audit needs source-aware import and backend registration checks. This adopts the frozen CI37b workflow and compatible AST/dependency audit sources on accepted mainfe8fb47b. The audit inventories first-party imports, checks kind/k3s registry and constructor/init boundaries, refuses source symlinks, and includes build-constrained/cgo imports while excluding the exact generated ui/node_modules directory after link refusal.

The original Linux mutation job failed before production audit because GNU AWK interpreted the Go braces in its factory-swap regex. The correction uses literal index($0, "return &kindBackend{}") > 0. It preserves the first-swap guard, replacement, rejection assertion and k3s behavior. The other four frozen source inputs are byte-identical. The predecessor hash-only PR1057 is accepted; this PR changes exactly five source paths, with every authority map/H, compiler1.26.5/lint2.12, module/sum and all3,525 non-owning Git bytes/modes conserved.

Current source: 95adbb5; tree: 85d5a2ff763805e33bdbb13dc9d5b9bdf7858634; sole parent: fe8fb47. Both fresh prepared-source reviews pass C0/I0; historical five passes, adverse reviews, original GNU failure and acknowledged Minor follow-ups remain recorded. Exact committed custody supplements are running.

Supporting Mac Go1.27.1 proof passed213 AST cases, real cloud/Kubernetes/dependency audit, mutation suite, trusted11-workflow policy, vet/compatible lint/actionlint and shell syntax. Complete policy harness passed33.383s; its unchanged core/guard package results were cached, while actual shell/root controls executed. This is exact-byte precommit supporting evidence; fresh owning Linux core/guard/full harness, GNU audit, full source/security/required checks and actual main/snapshot acceptance remain mandatory.

Original hosted Linux153-package/race/coverage/build/lint/UI/canonical successes belong to oldc8. Original GNU mutation failure and advisory incomplete benchmark comparison remain historical failures; neither proves this corrected head. No Task9 promotion, Go1.27.2 wave, stable release, deployment, credential or Compute runtime acceptance is claimed.

Rollback must use a reviewed transition admitted by the installed trust rules. Before promotion, reversing already-realized staged37b is refused; a source-only revert to fe8 is not an admitted rollback. Preserve that pre-promotion refusal. After promotion, any reversal must first establish the appropriate lawful authority/source transition and its owning validation; no ordinary-revert promise bypasses the guard. No guard, protection, failed-check exception or extra source boundary is changed by this PR.