Implement team-specific multitenant runtime wiring and standardize Kubernetes tests on kind

[bill-ph]

Summary

• add team-specific runtime resolution for worker namespace, service account, and runtime config secret selection
• update team router reconciliation to rebuild stacks on runtime or memory budget changes and keep the existing stack on replacement failure
• extend K8s worker pool wiring so workers can consume team-specific runtime config secrets
• render managed warehouse runtime artifacts from the config-store contract, including safer DuckLake metadata-store and S3 handling
• standardize local and CI Kubernetes testing on kind, keep OrbStack as an optional path, and reorganize K8s manifests into shared/, kind/, and orbstack/
• update docs and the multitenant plan to reflect the new runtime-config ownership and completed worker-pod work

Testing

• just lint
• go test -tags kubernetes ./controlplane -count=1
• go test ./tests/k8s -count=1
• go test -c -tags k8s_integration ./tests/k8s
• just test-k8s-integration