fix(ci): make cluster release gates reproducible

[usr-bin-roygbiv]

Problem

Post-merge cluster release proof exposed two Kubernetes-hosted Woodpecker failures that the existing CI contract did not bound:

• the Go operator compile exceeded its 2 GiB memory and ephemeral-storage limits;
• the legacy authority build ran in a Bun-only image without Cargo, then inherited a changed working directory across commands.

Decision

• Pin the legacy authority build to the same Rust 1.86 image used by the session runtime.
• Install the pinned Bun runtime into .ci and assert exact tool versions before building.
• Run each legacy authority command in an isolated subshell.
• Bound the operator gate at 4 GiB memory / 6 GiB ephemeral storage with serialized Go compilation.
• Encode every resource/toolchain/dependency invariant in cluster-ci-contract.test.mjs.

TDD / proof

• Expected red: Woodpecker pipeline 69 at 7342576c018c7427e83b9cba62962c1e51d03088 rejects the old 2 GiB operator limit.
• Source failure: pipeline 70 proved the 2 GiB ephemeral-storage eviction; pipeline 72 proved the missing-Cargo authority image.
• Passing candidate: Woodpecker pipeline 75 at 9d516261837d2f2b25ee962a3e041335c441efb0 is running the full gate set: http://woodpecker-ci-dev.tailb18de3.ts.net/repos/38/pipeline/75/1

Follow-up to the maintainer-merged cluster operator PR #115. No product behavior or default-off policy changes.

[riverpilot]

Merge blocker: the new contract asserts legacy-authority-build requests 6Gi memory and 12Gi ephemeral storage, while .woodpecker.yml still declares 4Gi and 6Gi. The cluster job fails at scripts/cluster-ci/cluster-ci-contract.test.mjs:284 (4Gi !== 6Gi), so the intended release proof never runs. Align the pipeline resources with the asserted contract (or correct the contract if 4Gi/6Gi is the intended ceiling), rebase current main, and rerun cluster + verify.

[riverpilot]

Aligned the Woodpecker limits with the asserted native-build headroom, rebased the complete contribution onto current main, and opened #132 as the replacement. The focused cluster contract now passes 13/13. Please close this superseded branch.

[iarbpairs]

Closing as superseded by #132, which aligns the Woodpecker resource limits with the executable cluster CI contract and is rebased on current main.