feat: add --exec-interactive-mode to auth update-kubeconfig

[ecv]

Summary

Adds --exec-interactive-mode to datumctl auth update-kubeconfig, letting callers set the exec credential plugin's interactiveMode directly instead of the hardcoded IfAvailable.

Closes #220.

Why

Non-interactive contexts (CI, scripts) have no TTY. The IfAvailable default forces callers to patch the generated kubeconfig after the fact:

datumctl auth update-kubeconfig --project p ...
kubectl --kubeconfig ... config set-credentials datum-user --exec-interactive-mode=Never

In datum-cloud/infra that patch is duplicated across ~15 Chainsaw test sites (datum-cloud/infra#2806). This flag removes the need for it.

Changes

• Add --exec-interactive-mode accepting Never / IfAvailable / Always
• Default IfAvailable — no behavior change for existing callers
• Validate the value; error on anything else
• Table test covering default, each valid mode, and rejection

Validation

$ datumctl auth update-kubeconfig --project p --hostname https://api.example.test \
    --exec-interactive-mode Never --kubeconfig /tmp/kc
$ grep interactiveMode /tmp/kc
      interactiveMode: Never

$ datumctl auth update-kubeconfig --project p --exec-interactive-mode Bogus
error: invalid --exec-interactive-mode "Bogus": must be one of Never, IfAvailable, Always

go build ./..., go vet, and go test ./internal/cmd/auth/ all pass.