echonet: pin kubernetes client below v36 to fix in-cluster auth

[ron-starkware]

v36.0.0 of the kubernetes Python client stores the in-cluster token under api_key["authorization"] while auth_settings() now reads api_key["BearerToken"], so no Authorization header is sent and the API server rejects requests as system:anonymous.

[cursor]

PR Summary

Low Risk
Single-line dependency constraint in deployment startup; restores expected in-cluster RBAC behavior with no application logic changes.

Overview
The echonet container startup pip install now pins the Python kubernetes client to versions below 36 ('kubernetes<36') instead of installing the latest release.

This avoids kubernetes 36.0.0, where in-cluster token storage and auth_settings() no longer align, so the API client can omit the Authorization header and the cluster sees system:anonymous instead of the pod service account.

^{Reviewed by Cursor Bugbot for commit 45bb99b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[matanl-starkware]

@matanl-starkware reviewed 1 file and all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on ron-starkware).