Epic: automated test coverage for the provider contract and component integrations

The providers talk to Symphony through strict contract. HostFactory runs a shell script, reads JSON from stdout, and checks the exit code. No automated test verifies this contract today.

This epic tracks the test work that closes the gap. The scope is tests only. No feature work and no fixes. Each item below becomes its own child issue when someone picks it up.

**Current coverage:**

Unit tests cover the GCE provider, the GKE provider, and the operator. The kind integration tests exercise the operator inside a real cluster. Pull request #98 adds the first two subprocess contract tests. The items below build on that foundation.

**Work items:**
- [ ] hf-gce contract tests. Run the real CLI as a subprocess with the environment Symphony sets. Cover all HostFactory commands. Validate responses agasint checked-in JSON schemas.
- [ ] hf-gke contract tests. Same apprach for the GKE provider.
- [ ] hf-monitor unit tests. Cover event parsing and the database update logic.
- [ ] GCE and hf-monitor integration. Seed the SQLite database with known machine states and assert the status command report them correctly. Run hf-monitor against the official Pub/Sub emulator, publish synthetic lifecycle events, and assert the database and status responses update.
- [ ] GKE and operator integration. Drive the existing kind setup through `hf-gke` instead of `kubectl`. Cover the full lifecycle: request machines, poll status, return machines, poll again. This is the first test of the seam between the CLI and the operator.
- [ ] Binary tier. Run the contract suites against the built PyInstaller binaries in the build_rpm workflow, on the same EL versions the RPMs ship for.

**Notes:**
- The two contract-tests items share one test driver. Whoever start first builds it.
- Contract tests build on #98 and absorbs its test files once it merges.
- Validation against a real Symphony cluster stays manual. That's deliberate. The work above reduces how often it is needed.

**Definition of done:**

Every component and test level in the coverage table is either covered by an automated test or marked manual by choice. The table gets updated as items land.

Start with pull request #98 and its subprocess contract tests, then inspect the existing GCE, GKE, operator, and kind integration tests named in the issue. Split the listed work into child issues and track coverage against the table. Done means each component and test level is automated or deliberately marked manual, with the table updated.

Written by the indexing model from the issue text.