Vendor envsubst into local bin instead of relying on system PATH

[KevFan]

Is your feature request related to a problem? Please describe.

The Makefile depends on envsubst in two targets — authorino-manifests (expands ${AUTHORINO_GITREF} / ${AUTHORINO_IMAGE_TAG} into config/authorino/kustomization.yaml) and bundle (expands ${REGISTRY}, ${ORG}, ${IMAGE_TAG}, ${BUNDLE_VERSION} into the CSV). Because authorino-manifests is a prerequisite of manifests, this dependency transitively reaches a large part of the workflow (test, deploy, install-operator, bundle, prepare-release, verify-*, …).

However, envsubst is an undeclared, assumed-on-PATH dependency. It's the only tool the Makefile uses that isn't version-pinned and vendored into $(LOCALBIN). Every other tool (controller-gen, kustomize, yq, opm, helm, kind, setup-envtest, ratchet) is installed via the go-install-tool macro. This means contributors on a minimal environment — e.g. macOS without brew install gettext, or a slim CI image — hit a confusing failure, and builds aren't fully reproducible.

Describe the solution you'd like

Vendor envsubst into $(LOCALBIN) following the exact pattern already used for the other tools, using the pure-Go implementation github.com/a8m/envsubst (installable via go install). The templates only use plain ${VAR} substitution, so the Go port is fully compatible.

1. Add tool variables alongside the existing ones:

   ENVSUBST ?= $(LOCALBIN)/envsubst
   ENVSUBST_VERSION ?= v1.4.2
   ENVSUBST_V_BINARY := $(LOCALBIN)/envsubst-$(ENVSUBST_VERSION)
   
   .PHONY: envsubst
   envsubst: $(ENVSUBST_V_BINARY) ## Download envsubst locally if necessary.
   $(ENVSUBST_V_BINARY): $(LOCALBIN)
      $(call go-install-tool,$(ENVSUBST),github.com/a8m/envsubst/cmd/envsubst,$(ENVSUBST_VERSION))

2. Add envsubst as a prerequisite of the authorino-manifests and bundle targets.
3. Replace the bare envsubst invocations with $(ENVSUBST).

Describe alternatives you've considered

• Leave it as-is and document the requirement in the README/CONTRIBUTING (install GNU gettext). Lower effort, but keeps the hidden host dependency and the reproducibility gap.
• Drop envsubst entirely and do the variable substitution another way (e.g. yq/sed, or kustomize replacements, both of which are already vendored). More invasive and changes the template approach; not worth it for this scope.

Additional context

• The bare envsubst calls are at Makefile:228 and Makefile:337.
• Note a8m/envsubst, like GNU envsubst, substitutes every env var it finds in the input; since these templates reference only the intended variables, this behaves correctly here.
• Good first issue: it's a small, well-scoped change that mirrors an existing, well-established pattern in the same file.