test(kubernetes): add SPIFFE e2e coverage

[TaylorMutch]

Summary

Add an opt-in Kubernetes SPIFFE e2e path and run it from the regular test:e2e Kubernetes workflow after the standard Kubernetes smoke test.

Related Issue

Follow-up to #1414

Changes

• Add mise run e2e:kubernetes:spiffe for focused SPIFFE supervisor-authentication coverage.
• Teach the Kubernetes e2e wrapper to install SPIRE and apply the SPIFFE Helm overlay when OPENSHELL_E2E_KUBE_SPIFFE=1.
• Add a Rust e2e that verifies sandbox pod SPIFFE wiring and confirms the supervisor uses JWT-SVID authentication instead of the K8s ServiceAccount bootstrap path.
• Run the SPIFFE e2e task from the reusable Kubernetes e2e workflow used by test:e2e.

Testing

• bash -n e2e/with-kube-gateway.sh
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-kubernetes --test spiffe_kubernetes --no-run
• mise run pre-commit passes
• E2E tests added/updated

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)