Add Kubernetes schemas and client protocol for SUNK monitoring [1/3]

[gustcol]

Summary

• Introduce KubernetesPodRow/KubernetesPodPayload and KubernetesNodeConditionRow/KubernetesNodePayload schemas following the existing Row + Payload(DerivedCluster) pattern
• Add KubernetesClient(Protocol) mirroring SlurmClient for pluggable Kubernetes data sources
• Zero new dependencies — pure data models and interface definition

This is the foundation for Kubernetes-layer observability in SUNK (Slurm-on-Kubernetes) clusters.

Stacked PR series: [1/3] → [2/3] K8s API client → [3/3] Collector CLI

Ref: #63

Test plan

• All 8 schema + protocol unit tests pass (test_kubernetes_schemas.py)
• ufmt formatting clean
• flake8 linting clean
• Existing test suite unaffected

[github-actions]

CI Commands

The following CI workflows run automatically on every push and pull request:

Workflow	What it runs
GPU Cluster Monitoring Python CI	lint, tests, typecheck, format, deb build, pyoxidizer builds
Go packages CI	shelper tests, format, lint

---

The following commands can be used by maintainers to trigger additional tests that require access to secrets:

Command	Description	Requires approval?
/metaci tests	Runs Meta internal integration tests (pytest)	Yes — a maintainer must trigger the command and approve the deployment request
/metaci integration tests	Same as above (alias)	Yes

Note: Only repository maintainers (OWNER association) can trigger /metaci commands. After commenting the command, a maintainer must also navigate to the Actions tab and approve the deployment to the graph-api-access environment before the jobs will run. See the approval guidelines for what to approve or reject.