feat(studio-cp): k8s identity/context observation — RuntimeContext for kubeconfig contexts (slice 3e)

[brettchien]

Summary

Sub-slice 3e of #97 (K8s driver — ADR #63 slice 3): observe_k8s_identity, the k8s counterpart to the already-shipped AWS observe_identity (runtime-identity-context ADR-19). Same RuntimeContext struct, populated per ADR-19's AWS-driver/k8s-driver field mapping table:

field	AWS (observe_identity, existing)	k8s (observe_k8s_identity, this PR)
principal	STS caller ARN	SelfSubjectReview username
principal_kind	role / user / unknown	service-account / user / unknown
scope	account id	{cluster}/{namespace}
location	region	(empty — no k8s equivalent)
source	container-creds / profile / env hint	kubeconfig context: <name>
caller_id	STS UserId	SelfSubjectReview's UserInfo.uid

principal/caller_id come from a live SelfSubjectReview call (authentication.k8s.io/v1, stable since k8s 1.28 — the literal API kubectl auth whoami uses), not a value read out of the kubeconfig file. That matches observe_identity's own shape: a live STS GetCallerIdentity, not trust in the configured profile — this ADR exists specifically because a configured identity silently not being the effective one was a real incident.

context = None uses the kubeconfig's current-context, mirroring K8sDriver::from_context's (#99) "ambient default, explicit override" shape — same path orbstack's local cluster will use later (3f).

location is deliberately left empty — k8s has no first-class region/zone concept the way AWS does, so there's nothing honest to fill in (same "empty if unset" contract observe_identity's own location already has when region is unset).

Scope note

This isn't stacked on #98/#99/#100 — it only touches studio-cp and doesn't use K8sDriver at all (does its own kubeconfig resolution, same pattern observe_identity already uses for AWS — it doesn't go through EcsDriver either). Branches from main directly.

Wiring this into the console panel itself, and FleetBinding gaining k8s fields (context/cluster/namespace) to select which identity to show, is 3f.

Testing

cargo test -p studio-cp (18/18, 1 new) — clean. cargo clippy -p studio-cp shows a couple of pre-existing warnings elsewhere in studio-cp/studio-compose (untouched by this change, not part of CI's gate for these crates) — nothing new from this diff.

Ref #97.