feat(workload): --ephemeral mode to validate/scan operator-rendered children (#5344 Phase 3b)

> 🤖 Generated by the Daily AI Assistant

## Problem

A GitOps repo expresses desired state at three layers. `ksail workload validate` / `scan` now cover **layers 1 & 2 fully offline** — Kustomize overlays + Helm-via-`HelmRelease` are rendered in-process and piped through kubeconform/kubescape (shipped in #5356, `Part of #5344`) — and **layer-3 CR _shape_** is schema-validated via `--include-crd-schemas` (#5905, Phase 3a; rendered-output CRD extraction tracked in #5906).

What is still **never seen offline** is what layer-3 operator CRs *expand into*: CNPG `Cluster`, KEDA `ScaledObject`, Flagger `Canary`, `ExternalSecret`, cert-manager `Certificate`, … each materialises native workloads via **arbitrary controller code at runtime**, for which no `helm template`-style offline renderer exists. So a chart/CR that is individually valid can still produce a privileged, schema-invalid, or policy-violating *child* that no shift-left `validate`/`scan` catches today.

## Proposed direction — opt-in `--ephemeral`

KSail is uniquely positioned to close this: it already owns the cluster lifecycle and the operator-install machinery. Add an **opt-in, default-off `--ephemeral`** mode to `validate`/`scan` that:

1. Stands up a **throwaway KWOK/Kind cluster** (KWOK preferred for cheap, API-only expansion where operators don't need real workloads).
2. Installs the **declared operators** — reuse the now-complete #4899 machinery: `pkg/svc/installer` (`Factory` + per-operator `Installer`s: cni, flux, certmanager, clusterautoscaler, …) and the cluster provisioner/`Connector`.
3. Applies the rendered manifests and **validates/scans the operator-rendered children** (admission policy + a `kubescape` cluster scan), with per-layer attribution in the output.
4. Tears the cluster down deterministically (timeout + guaranteed cleanup).

Offline-by-default stays the norm; **the `--ephemeral` flag is the gate** (feature-flag-first: default-off, both states tested, cluster access opt-in only).

## Rough size — L (multi-PR); suggested decomposition
- **3b-1** ephemeral cluster provision + guaranteed teardown seam (KWOK first).
- **3b-2** operator-install wiring driven off the declared `HelmRelease`/component set.
- **3b-3** apply rendered manifests → cluster-scan/validate the children; per-layer attribution.

## Open questions
1. Distro: KWOK-only first (API-shape children) vs Kind for operators that need real workloads?
2. Operator-set discovery: infer from declared `HelmRelease`s/components, or an explicit `--operators` list?
3. Cleanup/timeout guarantees on interrupt (leaked throwaway clusters are the main risk).

Part of #5344. Depends-on capability from #4899 (now complete). Sibling: #5906 (Phase 3a rendered-CRD schemas).

Start with the validate and scan commands, then inspect pkg/svc/installer, the Factory and per-operator installers, and the cluster provisioner/Connector from #4899. Define the ephemeral cluster lifecycle, operator wiring, child validation or scanning, feature-flag behavior, and guaranteed cleanup before implementation; done should include both flag states and deterministic teardown.

Written by the indexing model from the issue text.