rpk: add k8s managed plugin command (rpk k8s) [K8S-851]

[RafalKorepta]

Adds rpk k8s as a managed rpk plugin (slug k8s), modeled on the existing rpk ai plugin. Today the Kubernetes CLI ships only inside the redpanda-operator repo; this makes it discoverable and installable straight from rpk. On the first rpk k8s <subcommand>, rpk downloads the matching binary from https://rpk-plugins.redpanda.com/k8s/manifest.json, verifies its sha256, caches it at ~/.local/bin/.rpk.managed-k8s, and execs it. The binaries + manifest are published by the paired operator PR: redpanda-data/redpanda-operator#1611.

New package src/go/rpk/pkg/cli/k8s/ (replacing a stale, never-wired package connect scaffold):

• client.go — slug k8s, repo client.
• k8s.go — init() registers the managed plugin (plugin.RegisterManaged); NewCommand auto-installs on first subcommand and execs the plugin; adds install/uninstall/upgrade.
• hook.go — flag-strip only. Unlike rpk ai, the k8s plugin reads kubeconfig itself (kubectl-style), so no cloud token/endpoint/env is injected.
• install.go / upgrade.go / uninstall.go — lifecycle: manifest lookup, download+verify, --plugin-version, --force, --no-confirm. FIPS is gated (no FIPS build yet; tracked separately under K8S-851).
• Wired into root.go; BUILD files added.

Pairs with redpanda-data/redpanda-operator#1611. Refs K8S-851.

Backports Required

• none - not a bug fix
• none - this is a backport
• none - issue does not exist in previous branches
• none - papercut/not impactful enough to backport
• v26.1.x
• v25.3.x
• v25.2.x

UX Changes

• New top-level command rpk k8s for interacting with Redpanda clusters on Kubernetes. The plugin binary is downloaded and managed automatically on first use; it can also be managed explicitly with rpk k8s install (--plugin-version, --force), rpk k8s upgrade (--no-confirm), and rpk k8s uninstall.
• The plugin's own subcommands (e.g. rpk k8s multicluster ..., rpk k8s version) are provided by the downloaded binary.
• Not available on FIPS builds of rpk: rpk k8s install exits with a clear "not yet available in FIPS mode" message.

Release Notes

Features

• Add rpk k8s, a managed plugin for interacting with Redpanda clusters running on Kubernetes. On first use rpk auto-downloads, checksum-verifies, and caches the plugin from the Redpanda plugin repository; manage it explicitly with rpk k8s install / upgrade / uninstall.

[vbotbuildovich]

CI test results

test results on build#85905

test_status	test_class	test_method	test_arguments	test_kind	job_url	passed	reason	test_history
FLAKY(PASS)	ShadowLinkTopicFailoverTests	test_producer_ids_failover	{"storage_mode": "local"}	integration	https://buildkite.com/redpanda/redpanda/builds/85905#019ed5d8-a59f-4ffd-be8b-46def0324195	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0008, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3487, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=ShadowLinkTopicFailoverTests&test_method=test_producer_ids_failover