test: report missing kubectl checks as skipped

[joerosbury]

Summary

• detect kubectl availability once when the manifest test module loads
• register the two kubectl-dependent checks with test.skipIf(...)
• preserve the existing manifest assertions when kubectl is available

Previously, when kubectl was unavailable, the two tests printed a warning
and returned normally. Bun and JUnit therefore reported those checks as
passing instead of skipped.

Validation

Without kubectl:

• 1 passed
• 2 skipped
• 0 failed
• JUnit reports skipped="2"

With checksum-verified kubectl v1.37.0 available:

• 3 passed
• 0 failed
• all manifest assertions executed

Repository validation:

• Warren pre-commit gates: 12/12 passed
• git diff --check: passed

The two optional Linux+bwrap sandbox tests were skipped in the controlled
validation environment because bwrap was intentionally unavailable; no
bwrap-related source changes are included in this PR.

Fixes #1233

[jayminwest]

Great work @joerosbury, thanks for the PR!