CLIENT-5554 Add L3 pass-through tests against a kind and AKO cluster

Summary

Adds the first Kubernetes tests: pass-through translation against a cluster whose alternate access addresses the Aerospike Kubernetes Operator renders. The client seeds through the endpoint and has no translation map, no port arithmetic and no seed provider; every peer comes from what the server advertises. Test code and test scripts only.

• Shared endpoint (sharedEndpointAdvertisesEachPodNodePortAndRoutesEveryPartition): every node carries the same endpoint hostname as its configured-alternate-access-address label, with multiPodPerHost: true. The test scales the cluster to 2 pods and asserts that each pod advertises the hostname with its own Service NodePort, read back from the API server. It also asserts that the client holds one node per pod and owns all 4096 partitions, that each node serves a write and a read, and that the seeded node is also reachable at its advertised address. This is the cluster setup-kind-ako builds and the one CI runs.
• Per-node hostnames (perNodeEndpointsAdvertiseEachWorkerHostnameAndRouteEveryPartition): one pod per kind worker with multiPodPerHost: false, and a distinct hostname label per worker. setup-kind-ako cannot build this yet, so it runs from the local runner's per-node profile and skips elsewhere. CLIENT-5772 adds it to the action.

SuiteDiscoveryK8s is the class .github/discovery/run-l3-suite.sh in #699 runs, and it reads only the variables that script sets. Without a cluster, every test skips with a message naming the runner and the workflow.

test/discovery/run_l3.sh builds the same cluster locally from setup-kind-ako at the aerospike/shared-workflows#336 head (69ad6907). The client dials each kind node's address, as the workflow's client does on a Linux runner. A macOS host cannot reach that address, so the client runs in a container on the kind network in both profiles. The script never writes /etc/hosts or calls sudo, and it refuses to reuse or delete a kind cluster it did not create.

The pin needs moving to main once aerospike/shared-workflows#336 merges. #336 no longer pins or reports the NodePort range, so the tests no longer check NodePorts against 30000-32767. They still check that every pod has its own NodePort and that it matches what the server advertises. #699 still pins 703eeb9a and needs the same range check removed before it moves to 69ad6907.

Testing

Local, kind on Podman (KIND_EXPERIMENTAL_PROVIDER=podman), AKO 4.5.0, server 8.1.2.5 Enterprise, setup-kind-ako at 69ad6907:

• run_l3.sh default profile: Tests run: 2, Failures: 0, Errors: 0, Skipped: 1. Pods advertised as-endpoint.test:31057 and :30786, matching their Service NodePorts, and the client held both nodes at those addresses on the kind node (10.89.0.3). 4096/4096 partitions owned, 2048 per node, and a write and read per node.
• L3_PROFILE=per-node: Tests run: 2, Failures: 0, Errors: 0, Skipped: 1. The operator rendered node-1.as-endpoint.test:3000 and node-2.as-endpoint.test:3000, routing was the same, and the seeded node was reached at its advertised name.
• At the previous head (9ab82802), not rerun for this change: without a cluster both tests skip. run_l2.sh default profile unchanged at 47/0/25. Client unit tests 220/0, SuiteSync 813/0.
• No kind cluster, container or network left behind after a run.

CLIENT-5554