🐛 eventing: five manifest assertions skip in CI, so the Secret-vs-ConfigMap rule is unenforced there #894

Raised in the #884 and #883 reviews. Five manifest assertions are @needs_kubectl and
skip in CI, so they are promises that only hold on a laptop.

The problem

tests/test_manifests.py's render() shells out to kubectl kustomize:

def render(overlay: str) -> str:
    r = _run(["kubectl", "kustomize", str(OVERLAYS[overlay])])

kubectl is not on the CI runner, so every test marked @needs_kubectl skips — currently
reported as 5 skipped on every run, in both CI and most sandboxes. The assertions that
do not run include:

• test_no_phase3_secret_is_inlined_into_a_manifest — the §8.3 Secret-vs-ConfigMap rule,
  which is the whole of T22
• test_the_test_overlay_mounts_no_credential_so_mock_mode_is_automatic — fixed in feat(eventing): Phase 2 — make event signing deployable on a cluster #884
  precisely because it had stopped meaning what it documented, and still not exercised
  automatically
• test_no_credential_is_ever_rendered_into_a_manifest
• the replicas invariants for both Deployments

So a manifest change that violates any of these merges green. #884 found one case of a
manifest assertion silently ceasing to mean anything; nothing automated would have caught
the next.

Why this is cheap to fix

kustomize is a separate binary from kubectl, and it is present in environments
where kubectl is not — including the sandbox where both of those reviews were run.
kubectl kustomize and kustomize build produce the same output for these overlays.

So render() can fall back:

def _kustomize_argv(path: str) -> list[str] | None:
    if shutil.which("kubectl"):
        return ["kubectl", "kustomize", path]
    if shutil.which("kustomize"):
        return ["kustomize", "build", path]
    return None

and needs_kubectl becomes needs_kustomize, skipping only when neither is available.
The tests that genuinely need a cluster (needs_cluster, for API-server-defaulted JSON)
are unaffected and should keep skipping.

Worth checking before doing it

• Does CI have either binary? If neither, this needs a setup step in the workflow —
  still worth it, since kustomize is a single static binary, but it changes the shape
  of the fix from "a fallback" to "a fallback plus a CI change".
• Do the two renderers agree byte for byte on all four overlays? They should for
  these manifests, but the assertions are string-matching against indentation, so it is
  worth diffing rather than assuming. If they differ, the assertions may need \s*
  loosening — test_manifests.py already does that in several places for related reasons.

Why it was not done in #883 or #884

Both reviews flagged it and both concluded it is bigger than a docs or feature PR should
carry: it is test infrastructure affecting five assertions across two phases, and it
deserves its own verification that the fallback renders identically. Filing it so it is
not rediscovered the next time a manifest assertion stops meaning anything.

Phases 1–3 (the assertions span all three). Not blocking anything.