fix: restore the SSA inventory applier vk-sandbox consumes

[CMGS]

87e3263 cut NewSSAInventoryApplier as an unwired constructor. It is unwired in this repo — the consumer is vk-sandbox, whose startInventoryPublisher builds it to publish node inventory:

pub := inventory.NewPublisher(o.nodeName,
    inventory.NewLiveSource(p, lister),
    inventory.NewNodeInfoSource(advertiseAddr, lister),
    scale.NewSSAInventoryApplier(cclient, "vk-sandbox"),   // <- deleted
    o.log.WithName("inventory"))

So vk-sandbox does not compile against sandbox-operator HEAD. It builds today only because its go.mod still pins v0.0.0-20260726160753-0c71cfef8125, which predates the cut.

pkg/scale publishes the whole node-side publisher toolkit — NodeInventory, NodeInventoryGVK, InventoryApplier, NodeLiveSource, NewNodeInventoryPublisher — and this was its only production applier; StaticInventorySource is the in-memory test double. Shipping the toolkit without the applier leaves every out-of-tree publisher hand-rolling SSA against the GVK, which is the drift the type exists to prevent.

Restored verbatim, minus the comment the InventoryApplier godoc already carries, plus TestSSAApplier_UpsertsOneObjectPerNode: publish through a client, assert the object lands under the node name, republish, assert one object carrying the new entries. Mutation-checked — corrupting the applied name fails the test.

Verified: go build ./..., go test ./..., make lint (0 issues on linux and darwin), asl ./... clean on both GOOS; go build ./... in vk-sandbox under the shared go.work passes again.

Follow-up once this lands: bump vk-sandbox's sandbox-operator pseudo-version so its pinned build and the workspace build agree.