deploy/kubernetes: reconcile Agent Service Flow CRDs to runnable workloads

Goal Turn the alpha Kubernetes CRDs into a minimally runnable deployment path so teams can deploy services, agents, and flows through one native Kubernetes lifecycle.

Scope

• Add an opt-in controller/reconciler skeleton for Agent, Service, and Flow resources.
• Reconcile each resource into a Deployment/Service shape wired with labels/status conditions.
• Keep generated manifests and controller behavior additive and alpha.
• Include envtest/fake-client style tests or narrow unit tests for reconcile output.

Acceptance criteria

• Applying an Agent, Service, or Flow custom resource produces the expected workload spec in tests.
• Status conditions expose ready/error state for the inner-loop/deploy story.
• go test ./deploy/kubernetes/... passes.