OSS readiness phases A+B: CI fixes, hardening, and GPU-free conformance path

[cezarc1]

Part of the OSS-readiness plan (phases A-D) toward a public launch alongside nightjet.

Phase A — CI, multi-arch, hygiene

• Upgrade msgpack 1.2.0 -> 1.2.1 (GHSA-6v7p-g79w-8964); unblocks the pip-audit gate and resolves the Dependabot alert.
• Install cargo-deny, kubeconform, and gitleaks from pinned release binaries; fixes the broken go install gitleaks step and removes ~3 min of tool compilation.
• Default CONTROLLER_PLATFORMS to linux/amd64,linux/arm64 so the controller schedules on Jetson-only clusters.
• just secrets scans git history in addition to the working tree. Manual pattern sweep of history found no secrets.
• Harden the controller pod (non-root 10001, read-only root fs, seccomp, dropped caps) and the runtime image (USER 1000); documented .trivyignore for KSV-0056 (the operator must manage Services).

Phase B — stranger-runnable conformance path (no GPU)

• target.deviceClass: dev: drops nvidia.com/gpu requests and JetPack host mounts, uses emptyDir for artifact-work, selects the wrapper's stub backend, and defaults the contract smoke to a synthetic (PVC-free) payload.
• runtimes/fake/: the real Rust wrapper on a slim base with KUBEJET_BACKEND=stub — production endpoints, fake transcripts.
• just e2e / hack/e2e-kind.sh: builds controller+stub, loads into kind, installs the chart, runs tests/e2e conformance: ServingReady gating, admission rejection (bad-maxbatch), controller rejection with conditions (over-budget), and drift repair.
• CI: new e2e job runs the kind conformance suite on every PR.
• docs/quickstart-kind.md: five-minute no-hardware quickstart.
• examples/bad-maxbatch-rejected.yaml gains the required serving.streaming field so admission rejects it for the intended reason.