feat: run k3s in CI for self-contained Zarf deploy test

[RuBiCK]

Summary

Replaces the external cluster dependency (KUBECONFIG_B64 secret) with an ephemeral k3s cluster running directly on the GitHub Actions ubuntu runner. No secrets or external access needed.

Deploy job flow

Start k3s (v1.29.4) on runner
  └─ zarf init          (~421 MB init package, installs internal registry + agent)
       └─ Pre-deploy state snapshot
            └─ zarf package deploy
                 └─ Post-deploy fixes (namespace label, registry secret, rollout restart)
                      └─ Verify: assert running tags == expected sha-XXXXXXX

Architecture TODOs (documented inline)

For real production air-gap delivery, replace the k3s-in-CI step with:

• Option A — Upload tarball to S3, grant target environment read access
• Option B — USB transfer (see ZARF.md § Air-Gap USB Deployment)

Expected duration

Step	Estimate
Start k3s	~30s
zarf init (download + install)	~3-5 min
zarf package deploy	~30s
Post-deploy + verify	~2 min
Total	~8-10 min

🤖 Generated with Claude Code