Document Kubernetes support and verify it with a kind version matrix (#409 S5)

Part of #409: slice S5 of the capability-aware diagnostics design. Depends on S1–S3. #409 is not complete until this lands.

Scope

A Kubernetes support document. It defines verified and fixture-compatible, and records the oldest supported version, which the maintainer chooses from what the matrix verifies.
A kind version-matrix workflow:
- runs on GitHub-hosted runners;
- triggers on demand and when the capability modules change;
- starts with 1.33, 1.35 and 1.36, which is not a support claim;
- runs the design's read-only scenarios.

Each listed version runs the scenarios on hosted runners and adds no cloud cost.
Release notes can list the versions verified for that release.

core: a logical read reports the strongest failure and the run token

ci: run the version matrix on Kubernetes client changes

core: read a logical source through its candidates

tests: read-only version-matrix scenarios

ci: verify each supported Kubernetes version on kind

docs: Kubernetes support policy

core: a logical read reports the strongest failure and the run token

ci: run the version matrix on Kubernetes client changes

tests: pin the paging and budgets a logical read passes on

docs: take the verified versions from a run on the reviewed commit

ci: a matrix job verifies only the version it is named for

tests: check every budget and target a logical read passes on

ci: run the version matrix on dependency changes

docs: tighten the support and release claims; reset every matrix user

tests: pin the state of an Events read that fell through to core