feat: add BYO A2A harness

[EItanya]

Summary

• add a typed BYO harness for user-provided A2A images
• allow BYO templates to omit model configuration while preserving managed-harness validation
• share ADK configuration compilation between kagent and config-aware BYO agents
• use Kubernetes local object references with CEL constraints
• place command and args on the generic workload, requiring an explicit command for BYO
• intentionally defer image-owned egress configuration
• cover opaque and config-aware BYO agents in unit, CRD, compiler, and E2E tests

Testing

• focused API, translator, Substrate, controller, gRPC, E2E compile, and BYO fixture tests
• make lint
• make controller-manifests
• git diff --check
• controller and BYO fixture image builds

Live Kind was not rerun because the ate-api base contains a clean-install-only migration that cannot apply to the existing cluster. A clean cluster is required.