[FEATURE] Add --component flag for kustomize manifests #3167

Lets a caller add kustomize Components to the install without forking the manifests.

Owner: kustomize release workstream (#3169). Consumers: GKE workstream (ai-on-gke/substrate-gke#70), sizing workstream (#3165).
Specification.

Initial Spec:

• ate-setup deploy <target> --component <dir>, repeatable. Each <dir> must contain a kustomization.yaml with kind: Component; ate-setup exits non-zero otherwise, before any cluster call.
• Paths are resolved to absolute paths before rendering. User Components are appended after the built-in Components, in flag order, so a later Component wins on conflicting patches.
• Applied on every render path: deploy ate-system, atelet, apiserver, controller, the router and egress, Postgres, and the credential provider. Not applied to CRDs, or to kind-only paths (CSI driver setup, delete).
• ate-setup render (kustomize release workstream) accepts the same flag with the same semantics.
• The install-record behaviour for Component paths is defined in [FEATURE] Establish the ate-setup provider interface for extension #3189, the ate-setup interface.

Proposed. Stable name --component, documented as alpha until 1.0.

Open points

• PR ate-setup deploy accepts --component, and control plane sizing moves into kustomize Components #3179 rejects resources, generators, replicas and namespace in user Components, and does not apply them to SandboxConfig or CSI paths. Decide whether provider Components may add objects. The GKE PodMonitoring stays outside the GKE Component for this reason (Complete the GKE kustomize Component ai-on-gke/substrate-gke#152).
• Single-component deploys must apply user Components to ate-otel-config too. applyOtelConfig applies the raw file today, so Component patches are reverted on that path.
• Draft PR ate-setup: install a provider's object store plugin with --component and storage.backend=external #3651 adds a second --component implementation that stores Components in the settings registry (ATE_INSTALL_COMPONENTS, config key components), while ate-setup deploy accepts --component, and control plane sizing moves into kustomize Components #3179 keeps them out of the install record. Choose one, and update [FEATURE] Establish the ate-setup provider interface for extension #3189 to match.

Enforcement. A test Component that adds a label is rendered through each path, and the test asserts the label is on every workload the path renders and on no CRD.

Parent Issue: #3160. Unblocks #3168 and #3165.