[Request]: --publish option for `container k8s create`

### Feature or enhancement request details

`container k8s create` currently exposes no way to publish node ports to the host. The cluster container is created with a hardcoded `Flags.Management` whose `publishPorts` carries only the internally allocated API server port (`K8sHelper.clusterPort()`, host 6445+ → 6443) — and even that only when no DNS domain is configured:

```swift
publishPorts: fqdn == nil ? [try await K8sHelper.clusterPort()] : [],
```

The underlying publish machinery (the same one behind `container run --publish`) fully supports arbitrary specs for the node container; the k8s command just has no CLI surface for it.

Without this, NodePort services are reachable only via the node's vmnet IP, which is dynamic across cluster recreations (and documented as such), so anything that wants a stable host endpoint — an ingress controller on fixed NodePorts, a local dev domain resolving to `127.0.0.1` — has no supported path.

Proposed: a repeatable `-p/--publish [host-ip:]host-port:container-port[/protocol]` option on `k8s create`, parsed with the runtime's existing publish-spec parser, composed with (and colliding legibly against) the internal API server port allocation.

Example of what this enables:

```console
$ container k8s create --name dev --publish 80:30080 --publish 443:30443
$ container k8s list
NAME ... PORTS
dev ... 6445->6443,80->30080,443->30443
```

I have a working patch with tests and docs and will open a PR referencing this issue.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start at the `container k8s create` entry point, then read `Flags.Management`, `K8sHelper.clusterPort()`, and the existing publish-spec parser used by `container run --publish`. Confirm the tests and docs cover repeatable specs, API-port composition and collisions, and the example’s host mappings; done means `k8s create` exposes the option and `k8s list` reports the mappings.

Written by the indexing model from the issue text.