Refactor runtime for container backends

[MarcStdt]

Summary

• split the CLI into druid, druid-client, and druid-coldstarter binaries
• move OCI login/pull/push flows to druid-client and keep runtime selection daemon-only
• replace process/lock-file runtime state with container-backed Docker and Kubernetes runtime sessions
• add Kubernetes materialization, Jobs/StatefulSets, ConfigMap-backed scroll state, Hubble-aware ports, and tiered Job polling
• add refreshed examples, coldstarter image build support, VS Code configs, docs, and generated API updates

Validation

• GOTOOLCHAIN=go1.24.7 go test ./...
• ./scripts/validate_all_scrolls.sh
• GOTOOLCHAIN=go1.24.7 make build
• k3d smoke: container-lab materialization, ConfigMap recovery, ports, verify/report/stop

Notes

• make build still prints the existing OpenAPI 3.1 oapi-codegen warning, but succeeds.
• Hubble absence degrades Kubernetes port status as expected.

[druid-infra]

Error: This repo is not allowlisted for Atlantis.