feat(k8s): upgrade spec v1.32.0 to v1.36.2

[chant-lexicon-upgrade]

Lexicon upgrade: k8s

From: v1.32.0 To: v1.36.2
Semver label: breaking

Surface delta

Added (14):

• ClusterTrustBundle [resource] (K8s::Certificates::ClusterTrustBundle)
• ClusterTrustBundleList [resource] (K8s::Certificates::ClusterTrustBundleList)
• DeviceTaintRule [resource] (K8s::Resource::DeviceTaintRule)
• DeviceTaintRuleList [resource] (K8s::Resource::DeviceTaintRuleList)
• LeaseCandidate [resource] (K8s::Coordination::LeaseCandidate)
• LeaseCandidateList [resource] (K8s::Coordination::LeaseCandidateList)
• MutatingAdmissionPolicy [resource] (K8s::Admissionregistration::MutatingAdmissionPolicy)
• MutatingAdmissionPolicyBinding [resource] (K8s::Admissionregistration::MutatingAdmissionPolicyBinding)
• MutatingAdmissionPolicyBindingList [resource] (K8s::Admissionregistration::MutatingAdmissionPolicyBindingList)
• MutatingAdmissionPolicyList [resource] (K8s::Admissionregistration::MutatingAdmissionPolicyList)
• PodCertificateRequest [resource] (K8s::Certificates::PodCertificateRequest)
• PodCertificateRequestList [resource] (K8s::Certificates::PodCertificateRequestList)
• StorageVersionMigration [resource] (K8s::Storagemigration::StorageVersionMigration)
• StorageVersionMigrationList [resource] (K8s::Storagemigration::StorageVersionMigrationList)
  Changed (8):
  ~ CronJob
  now required: spec
  ~ EndpointSlice
  now optional: endpoints
  ~ HPA
  now required: spec
  ~ HorizontalPodAutoscaler
  now required: spec
  ~ IPAddress
  now required: spec
  ~ PriorityClass
  now optional: value
  ~ TokenRequest
  now optional: spec
  ~ ValidatingAdmissionPolicyBinding
  now required: spec

Severity: breaking

[lex00]

Closing: this branch was corrupted by a non-hermetic test run (root cause fixed in #547 — the upgrade Op's git calls now route through the injectable runner so tests can't touch the real repo). The k8s upgrade will be regenerated cleanly by the pipeline after #547 merges.