refactor(cluster): extract the repeated kubeconfig-resolution and drift-warn boilerplate

> 🤖 Generated by the Agentic Engineer

## Problem

Three drift checks in `pkg/cli/cmd/cluster/orchestrator.go` repeat the same two blocks:

1. resolve the kubeconfig path and, on error, `notify.Warningf` with a message differing only in the check's name, then return;
2. call the installer's drift function and, on error, warn in the same shape, then return.

The sites are `checkFluxDistributionVersionDrift`, `checkRegistryCredentialDrift`, and `checkFluxVerifyDrift`.

## Why it matters

The shared behaviour is *warn and skip rather than fail the whole update*. That is a deliberate policy decision, and with it written out three times a future change to the wording — or to the policy — can silently apply to only some of the checks.

## What

Extract a small helper so the three sites share one implementation, preserving current behaviour exactly.

## Acceptance criteria

- [ ] The three call sites share one helper; existing tests pass unmodified.
- [ ] No behaviour change — a warn-and-skip stays a warn-and-skip for each check.
- [ ] Shipped alone, not folded into a behaviour change.

Raised by CodeRabbit on #6454 and deliberately deferred there to keep that PR's subject a correctness fix.

Size: XS.

Start in pkg/cli/cmd/cluster/orchestrator.go and compare checkFluxDistributionVersionDrift, checkRegistryCredentialDrift, and checkFluxVerifyDrift. Extract their repeated kubeconfig-resolution and drift-warning flow into one helper while preserving each check's warning and skip behavior. Run the existing tests and confirm all three call sites use the helper without changing behavior.

Written by the indexing model from the issue text.