fix(ci): system tests fetch a third-party git repo at test time, so an external outage reds unrelated PRs

> 🤖 Generated by the Agentic Engineer

## Evidence

On 2026-08-03 two `🧪 System Test (Docker)` legs of one CI run failed identically, three retry
attempts each:

```
error: accumulating resources: accumulation err='accumulating resources from
'https://github.com/stefanprodan/podinfo//kustomize': URL is a git repository': hit 27s timeout
```

The failing legs were `K3s, Docker, --gitops-engine Flux` and `KWOK, Docker, --gitops-engine ArgoCD`
(run `30800079771`). Both fail at `ksail workload apply -k` against
`.github/fixtures/podinfo-overlay/kustomization.yaml`, whose `resources:` list is a **remote git
base**:

```yaml
resources:
- https://github.com/stefanprodan/podinfo//kustomize
```

so every run of this test clones a third-party GitHub repository at test time.

The same run also lost `zizmor` to a related external fetch — a **503** from
`https://github.com/goreleaser/goreleaser-action.git/git-upload-pack` during its `stale-action-refs`
online audit. Two independent checks red in fifteen minutes, both on GitHub git-protocol fetches,
neither caused by the PR under test.

## Affected audience and impact

Every KSail pull request. The failure is indistinguishable at a glance from a real regression: it
lands on the system-test matrix, mentions kustomize accumulation, and reports against the
contributor's diff. The cost is paid three ways — a false red on unrelated work, an agent or human
run spent diagnosing it, and a full re-run of a matrix whose Go legs take roughly 70 minutes. The
built-in 3× retry does not help, because a third-party outage outlasts ~30 seconds of retrying.

## Expected behaviour

The system-test suite exercises `ksail workload apply -k` against an overlay it owns, and passes or
fails only on KSail's own behaviour. A third-party repository being slow or unreachable does not
turn a KSail PR red.

## Acceptance criteria

- [ ] `.github/fixtures/podinfo-overlay/` resolves without network access to any third-party host —
the base is vendored into the fixture (or replaced by a local equivalent that exercises the
same kustomize accumulation path).
- [ ] The test still covers remote-base *accumulation*, so this does not become a weaker test: if a
remote base is what is under test, keep one narrowly-scoped case and let it be skippable
instead of gating the matrix.
- [ ] Proven by running the affected legs with the third-party host unreachable, not merely by a
green run on a good day. A green CI run is not evidence here — the current fixture is green on
most days too.
- [ ] Any remaining deliberate network dependency in CI is named, so the next occurrence is
recognised rather than re-diagnosed.

## Size

Small. Vendoring the base is mechanical; the judgement is only whether to keep one deliberate
remote-base case and how to keep the vendored copy current.

Filed with no Epic parent: KSail has no CI-reliability epic, and this does not fit any existing one.

Inspect .github/fixtures/podinfo-overlay/kustomization.yaml and trace the affected K3s and KWOK Docker system-test legs that run `ksail workload apply -k`; first reproduce them with the third-party host unreachable. Done means the fixture resolves without third-party network access, remote-base coverage is preserved only where appropriate, and any remaining deliberate CI network dependency is documented.

Written by the indexing model from the issue text.