Support protected workflow environments

[gjkim42]

What type of PR is this?

/kind api

What this PR does / why we need it:

Adds GitHub-compatible job environment parsing and a Kubernetes-native environment policy to Projects. Project environments can expose a scoped Kubernetes Secret and require per-job approval before a Runner can claim the job.

The controller resolves the selected environment into the immutable WorkflowJob spec, keeps approval-blocked jobs distinct from queued jobs, and reports environment state through Kubernetes conditions, the console, CLI output, and GitHub Checks. Environment secrets are copied into a job-owned Secret only after approval and Runner assignment, mounted only in that runner, masked from output, and cleaned up with the job.

This gives reusable E2E workflows a trusted ok-to-test boundary without allowing fork-controlled workflow inputs to select an unconfigured secret source or bypass environment protection.

Which issue(s) this PR is related to:

Fixes #29

Special notes for your reviewer:

Open Actions does not import GitHub Environment protection rules. The equivalent protection model is Project.spec.environments[].protection.requiredApproval, with approval recorded by the actions.kelos.dev/environment-approved annotation on an immutable WorkflowJob. Kubernetes RBAC and audit logging determine who may approve jobs.

The controller emits runner plan version 5. The updated runner remains compatible with plan versions 1 through 4.

Validation completed with make verify, make test, and make build. The Kubernetes API review verdict is APPROVE with no P0-P3 findings.

Does this PR introduce a user-facing change?

Projects can define protected workflow environments with scoped Kubernetes Secrets and require approval before environment jobs are scheduled.