feat: Implement Job container for apply operations

[kitsunoff]

⚠️ TDD MANDATORY

Tests MUST be written BEFORE implementation code. No exceptions.

All apply scenarios and error handling must have tests written FIRST.

---

Description

Implement the container/binary that runs inside Kubernetes Jobs to perform NixOS apply operations.

Tasks

Test First

• Test: Git clone success
• Test: Git clone failure (repo not found)
• Test: Git clone failure (auth failed)
• Test: nixos-rebuild success
• Test: nixos-rebuild failure (build error)
• Test: nixos-anywhere success
• Test: nixos-anywhere failure
• Test: SSH connection lost during apply
• Test: Timeout handling
• Test: additionalFiles injection (Inline)
• Test: additionalFiles injection (SecretRef)
• Test: additionalFiles injection (NixosFacter)

Binary Mode

• Add --mode=apply-job flag to main binary
• Parse job parameters from args/env
• Implement job-specific entrypoint

Git Operations

• Clone repository with SSH key or token
• Checkout specified ref
• Inject additional files from environment/secrets

Apply Execution

• Implement nixos-rebuild switch execution
• Implement nixos-anywhere execution for full installs
• Stream output for progress tracking
• Handle timeouts gracefully

Status Reporting

• Update NixosConfiguration status on completion
• Write result to configmap/annotation for controller pickup
• Log structured output for progress parsing

Security

• Run as non-root user
• Read-only root filesystem
• Mount SSH keys as read-only volume
• Drop all capabilities

Container Spec

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]

Reference

See docs/kubebuilder-migration-analysis.md sections 16, 22.