fix(k8s): validate kustomize build output in CI, remove dead components key

[TheWeirdDee]

Summary

Closes #322.

An earlier commit (6caaa40) had already wired pdb.yaml into k8s/kustomization.yaml's resources: and folded the standalone ingress.yaml into backend.yaml/frontend.yaml, plus added scripts/check-k8s-manifests.py for cluster-free static checks. This PR closes the three gaps that were still open against the issue's acceptance criteria:

1. The empty components: key. Removed. A Kustomize component composes partial patches into a base; k8s/scheduler/ ships its own Namespace and RBAC, so it's a full standalone base, not a component — it would have been structurally wrong to list it there even if populated. Documented instead as a separate Kustomization, applied on its own (kubectl apply -k k8s/scheduler/), in a comment at the top of the file. Also fixed a since-contradictory comment above pdb.yaml that still said "never referenced here" while sitting right next to its own resources: entry.

2. PDB-selector checks ran against raw source files, not "the built output." scripts/check-k8s-manifests.py's Ingress-backend, PDB-selector, and NetworkPolicy-admission checks now run against actual kustomize build k8s/ output (via subprocess) instead of manually re-parsing the referenced source files. This is strictly more correct — it would catch a selector or label broken by the namespace transform, a patch, or a future component, none of which the old source-parsing approach could see. Verified by reintroducing both defects the script targets (an unwired pdb.yaml, a PDB selector matching no workload) and confirming each fails with the right message.

3. No CI job ran kustomize build or a schema validator. Added a k8s-manifests job to ci.yml that installs kustomize v5.8.1 and kubeconform v0.8.0 (SHA256-pinned downloads, same pattern as the existing gitleaks install in secret-scanning.yml) and runs kustomize build | kubeconform -strict against both k8s/ and k8s/scheduler/, then runs the Python script above. Wired in the community CRD schema catalog (datreeio/CRDs-catalog) alongside kubeconform's built-in schemas, since k8s/ renders Argo Rollouts CRDs (Rollout, AnalysisTemplate) that kubeconform doesn't recognize out of the box — without it, -strict fails those two kinds as unrecognized even though they're valid.

Also fixed a stale docs/deployment-mainnet.md reference to k8s/ingress.yaml, which no longer exists (removed in 6caaa40) — the doc still described a tls block that isn't in the current inline Ingress definitions either.

Deployment-path authority: docs/deployment-mainnet.md already states k8s/*.yaml are local/dev-only and Helm is authoritative for real environments (testnet/Mainnet) — I carried that into a comment at the top of k8s/kustomization.yaml itself so it's visible from the manifest, not just the doc. k8s/scheduler/ and ml-workloads/ have no Helm templates at all, so they remain kustomize-only regardless.

Test plan

• kustomize build k8s/ — renders cleanly, all 4 PDBs present with selectors matching real workload pod labels (backend, frontend, ml-inference, summary-worker)
• kustomize build k8s/scheduler/ — renders cleanly (10 resources: Namespace, ServiceAccount, ClusterRole(Binding), Role(Binding), ConfigMap, Deployment, 2× NetworkPolicy)
• kustomize build k8s/ | kubeconform -strict -summary -schema-location default -schema-location <CRDs-catalog> — 37/37 valid, 0 errors
• kustomize build k8s/scheduler/ | kubeconform -strict -summary ... — 10/10 valid, 0 errors
• python3 scripts/check-k8s-manifests.py (with kustomize on PATH) — passes against current state
• Reintroduced the unwired-pdb.yaml defect → script fails with k8s/pdb.yaml is not referenced by kustomization.yaml; reverted
• Reintroduced a broken PDB selector (app: nonexistent-workload) → script fails with PodDisruptionBudget backend-pdb selects {...}, which matches no workload; reverted
• kustomize build k8s/ output is byte-identical before/after the components:/comment cleanup in kustomization.yaml (doc-only change, confirmed no behavior change)
• Downloaded and SHA256-verified the exact kustomize/kubeconform Linux binaries the new CI job installs, matching the checksums published in each project's release
• actionlint v1.7.12 against ci.yml — exits 0

[AbuJulaybeeb]

KIndly fetch upstream, rebase and push for merge